Multimedia Data Hiding Wade Trappe Wireless Information Network Laboratory Rutgers University

Outline Basic framework and issues in multimedia data hiding Two main embedding mechanisms Spread spectrum additive embedding (Deterministic) Relationship enforcement embedding Along with several examples and applications Watermark attacks and countermeasures Collusion Resistance

Why Hide Data in Multimedia

Crypto is Useful to Protect MM, but Not Enough … Encryption Helps to protect confidentiality Protection vanishes after decryption Prefer a way to associate copyright info. with multimedia source even after decryption/compression/transmission/etc. Digital cryptographic signature Helps to authenticate sender’s identity and data integrity Need to attach a separate signature to the data source Audio/image/video allows imperceptible changes Opportunities for new and seamless ways of authentication

Demands on Info. Security and Protection Intellectual property management for digital media Promising electronic marketplace for digital music and movies Napster controversy Conventional encryption alone still leaves many problems unsolved Protection from encryption vanishes once data is decrypted Still want establish ownership and restrict illegal re-distributions How to distinguish changes introduced by compression vs. malicious tampering? Bit-by-bit accuracy is not always desired authenticity criterion for MM

Multimedia Data Hiding / Digital Watermarking What is it? Example: Picture in picture, words in words It is “Steganography” Secondary information in perceptual digital media data Why hide information? Convey information without an additional channel Hidden data is tied to content: Can be made difficult to separate data from content. Covert communication: Adversary does not know it is there!

Data Hiding in Perceptual Data Perceptual data (audio/image/video) vs. non-perceptual Perceptually no-difference: allow small changes in terms of Hamming or Euclidean distance Non-perceptual data often have semantic or functional constraints hence cannot be easily changed in terms of Hamming or Euclidean distance Unequal importance within perceptual (multimedia) data High data volume and real-time requirements for multimedia Perceptual properties of multimedia allow for imperceptible but lossy processing Including lossy compression (JPEG, MPEG, …) and data hiding Data hiding examples in perceptual & non-perceptual data Hiding Data in text message e.g., change a word to one of its synonyms (Birthday Attack on Hashes) Hiding Data in scanned text message e.g., change line spacing or pixel values

General Framework of Data Hiding marked media (w/ hidden data) embed data to be hidden host media compress process / attack extract play/ record/… extracted data player 101101 … “Hello, World” test media

Issues and Challenges Tradeoff among conflicting requirements Robustness Capacity Imperceptibility Tradeoff among conflicting requirements Imperceptibility Robustness & security Capacity Key elements of data hiding Perceptual model Embedding one bit Multiple bits Uneven embedding capacity Robustness and security What data to embed Upper Layers Uneven capacity equalization Error correction Security …… Lower Layers Imperceptible embedding of one bit Multiple-bit embedding Coding of embedded data

Examples of Multimedia Data Hiding

Watermark-based Authentication Embed patterns and content features using a lookup-table High embedding capacity/security via shuffling locate alteration differentiate content vs. non-content change (compression) unchanged content changed

Relationship Enforcement Embedding Deterministically enforcing relationship Secondary info. carried solely in watermarked signal Representative: odd-even embedding No need to know host signal (no host interference) High capacity but limited robustness Robustness achieved by quantization or tolerance zone => Enforcing black pixel# per block to odd/even to hide data in binary image feature value 2kQ (2k+1)Q (2k+2)Q (2k+3)Q odd-even mapping lookup table mapping 0 1 0 1 … 0 1 1 0 … even “0” odd “1”

Relationship Enforcement (cont’d) General approach: Partition host signal space into sub-regions each region is labeled with 0 or 1 marked sig. is from a region close to orig. & labeled w/ the bit to hide Secondary info. carried solely in X’ difference (X’-X) doesn’t necessarily reflect the embedded data Advanced embedding: Combining the two types with techniques suggested by information theory mapping { b} data to be hidden X host sig. X’= f( b ) marked copy 1 or 0

Additive Embedding Add secondary signal in host media Representative: spread spectrum embedding Add a noise-like signal and detection via correlation Good tradeoff between imperceptibility and robustness Limited capacity: host signal often appears as major interferer modulation data to be hidden  X original source X’ = X +  marked copy 10110100 ... < X’ + noise,  > = <  + (X + noise),  > < X’ + noise - X,  > = <  + noise,  >

Spread Spectrum Approach: Cox et al (NECI) 4/17/2017 Spread Spectrum Approach: Cox et al (NECI) Key points Place wmk in perceptually significant spectrum (for robustness) Modify by a small amount below Just-noticeable-difference (JND) Use long random vector as wmk to avoid artifacts (for imperceptibility & robustness) Embedding v’i = vi +  vi wi = vi (1+ wi) Perform DCT on entire image and embed wmk in DCT coeff. Choose N=1000 largest AC coeff. and scale {vi} by a random factor 2D DCT sort v’=v (1+ w) IDCT & normalize Original image N largest coeff. other coeff. marked image random vector generator wmk seed

Cox’s Scheme (cont’d) Detection 4/17/2017 Cox’s Scheme (cont’d) Detection Subtract original image from the test one before running through detector Original detection measure used by Cox et al. a correlator normalized by |Y| – orig X test X’ X’=X+W+N ? X’=X+N ? DCT compute similarity threshold test image decision wmk select N largest original unmarked image preprocess –

Theoretical Foundations Optimal detection for On-Off Keying (OOK) OOK under i.i.d. Gaussian noise {di} b{0,1} represents absence vs. presence of ownership mark Use a correlator-type detector (recall the review last week) Need to determine how to choose {si} Neyman-Pearson Detection [Poor’s book Sec.2.4] False-alarm ~ claiming wmk existence when nothing embedded Given max. allowed false-alarm, try to minimize prob. of miss detection Use likelihood ratio as detection statistic Determine threshold according to false-alarm prob.

Performance of Cox’s Scheme 4/17/2017 Performance of Cox’s Scheme Robustness (claimed) scaling, JPEG, dithering, cropping, “printing-xeroxing-scanning”, multiple watermarking No big surprise with high robustness equiv. to conveying just 1-bit {0,1} with O(103) samples Comment Must store original unmarked image  “private wmk”, “non-blind” detect. Perform image registration if necessary Adjustable parameters: N and 

Invisible Robust Wmk: Improved Schemes Apply better Human-Perceptual-Model Global scaling factor is not suitable for all coefficients Explicitly computes Just-noticeable-difference (JND) JND ~ max amount each freq. coeff. can be modified imperceptibly Use i for each coeff.  finely tune wmk strength Better tradeoff between imperceptibility and robustness Try to add a watermark as strong as possible Block-DCT based schemes: Podilchuk-Zeng & Swanson et al. Existing visual model for block DCT: JPEG Quality Factors

Compare Cox & Podilchuk Schemes Original Cox Podilchuk whole image DCT block-DCT Embed in 1000 largest coeff. Embed to all “embeddables”

Compare Cox & Podilchuk Schemes (cont’d)

Video Example 1st & 30th Mpeg4.5Mbps frame of original, marked, and their luminance difference human visual model for imperceptibility: protect smooth areas and sharp edges

Some Watermark Attacks

Watermark Attacks: What and Why? Attacks: intentionally obliterate watermarks remove a robust watermark make watermark undetectable (e.g., miss synchronization) uncertainty in detection (e.g., multiple ownership claims) forge a valid (fragile) watermark bypass watermark detector Why study attacks? identify weaknesses propose improvement understand advantages and limitations of each solution

“Innocent Tools” Exploited by Attackers Recovery of lost blocks for resilient multimedia transmission of JPEG/MPEG good quality by edge-directed interpolation: Jung et al; Zeng-Liu Remove robust watermark by block replacement edge estimation edge-directed interpolation

Attack effective on block-DCT based spread-spectrum watermark JPEG 10% after proposed attack marked original (no distortion) 512x512 lenna Threshold: 3 ~ 6 Attack effective on block-DCT based spread-spectrum watermark claimed high robustness&quality by fine tuning wmk strength for each region

Secure Digital Music Initiative Challenge International consortium ~ 180+companies/organizations Currently pursuing watermark based solution for access and copy control on digital music use watermark to convey copy/access control policy Public challenge ( 9/15-10/8/2000 ) Attacks on four robust watermark technologies Non-traditional research values Reveal real industrial problem and state-of-art technologies Present an emulated competitive environment for better understanding on audio watermarking Lead to a few research problems

SDMI Challenge Setup GOAL Sample-3 (marked) Sample-4 (attacked) Embed Obtained From SDMI Job for “Attackers” Black Box (unknown) SDMI Challenge Setup Embed Watermark (special signal) Sample-1 (original) Sample-2 (marked) “Watermark Found” Detect Any Marked Audio “Watermark NOT Found” Attack Detect Sample-3 (marked) Sample-4 (attacked) GOAL

Can Ear Tell Difference? Liang Zhu Top of World Comparison among 3 samples: original, applying attack-1 to orig., applying attack-2 to orig. 2 / 0 / 3

Learning from SDMI Challenge Princeton University’s successful attacks Blind attacks: warping, jittering Attacks based on studying orig.-marked pairs deliberate filtering / subtraction / randomization Research issues What embedding framework/algorithm gives sufficient robustness as well as security? esp. when orig.-marked pairs are available to attacker Is watermark useful for copy/access control? Hard to get complete solution with technology alone business model, pricing model, etc. Improved watermark tech. could be part of the solution make attack non-trivial and keep honest people honest

Summary and Conclusions Data hiding in digital multimedia for a variety of purposes, involving multiple disciplines Tradeoff among many criterions Important to think both as designer and as attacker Emerging problems how to effectively combine with other security mechanisms Data hiding in market digital cameras with authentication watermark module plug-in for image editors video watermark proposals for DVD copy control on-going SDMI effort for digital music “Digital Rights Management (DRM)” for multimedia data

Summary Comparisons of data hiding in MM vs. non-perceptual Basic framework and issues in multimedia data hiding Two main embedding mechanisms Spread spectrum additive embedding (Deterministic) Relationship enforcement embedding Along with several examples and applications Watermark attacks and countermeasures

Suggested reading I. Cox, J. Kilian, T. Leighton, T. Shamoon: “Secure Spread Spectrum Watermarking for Multimedia'', IEEE Transaction on Image Processing, vol.6, no.12, pp.1673-1687, 1997. Download from IEEE online journal, or http://www.neci.nj.nec.com/homepages/ingemar/papers/ip97.ps C. Podilchuk and W. Zeng, “Image Adaptive Watermarking Using Visual Models,” IEEE Journal Selected Areas of Communications (JSAC), vol.16, no.4, May, 1998. Download from IEEE online journal M. Wu and B. Liu: “Multimedia Data Hiding”, Springer Verlag, to appear Dec. 2002. An earlier dissertation version is at http://www.ece.umd.edu/~minwu/research/phd_thesis.html.

Digital Fingerprinting and Tracing Traitors Recent advances in communications allow for convenient information sharing Severe damage is created by unauthorized information leakage e.g., pirated content or classified document Promising countermeasure: robustly embed digital fingerprints Insert ID or “fingerprint” to identify each customer Prevent improper redistribution of multimedia content content co. A Beautiful Mind Alice Bob Carl w1 w2 w3 Sell

Embedded Fingerprinting for Multimedia original media compress extract 101101 … Customer: Alice Sell Content Suspicious Candidate Search Database Fingerprint Tracing:

4/17/2017 Collusion Scenarios Collusion: A cost-effective attack against multimedia fingerprints Users with same content but different fingerprints come together to produce a new copy with diminished or attenuated fingerprints Colluders cannot arbitrarily manipulate embedded fingerprint bits Different from Boneh-Shaw’s marking assumption (1995) Result of fair collusion: energy of embedded fingerprints decreases . . . Averaging Attack Interleaving Attack

Anti-Collusion Fingerprinting Build anti-collusion fingerprinting to trace traitors and colluders Potential impact Gather digital evidence and trace culprits Deter unauthorized dissemination in the first place let the bad guys know their high risk of being caught Potential civilian use for digital rights management (DRM) DRM business ~ $96M in 2000 and projected $3.5B in 2005

Additive Embedding Overview 4/17/2017 Additive Embedding Overview Additive embedding is spread spectrum watermarking (Cox et al.): Content signal User j’s watermark is a noise-like signal: Watermark is scaled and added to content to make yj. sj wj x a yj Orthogonal Modulation: Code Modulation: We choose or . Typical WNR: -20dB in blind detection, 0dB in non-blind detection. Detection via hypothesis testing: correlator for AWGN Mention Ortho modulation we have amount of waveforms equal to amount of users. Mention that other possibilities are possible for bij, but that this is further directions to explore.

Additive Fingerprint Detection 4/17/2017 Additive Fingerprint Detection Detection can be formulated as a hypothesis testing problem. Optimal detector can be calculated from assumptions on distortion (host media and noise from attacks). If distortion is N(0, ) then optimal detector is a correlator: Example (Antipodal Code Modulation) Detection is similar to what you do in digital communication. TN b=1 b=-1

Approaches to Tracing Colluders Colluder identification via orthogonal fingerprints Prior works by Cox et al., Stone, Killian et al. Advantage in distinguishing individual fingerprints Disadvantage in fingerprint attenuation during collusion Colluder identification via correlated fingerprints Boneh-Shaw codes may be too long to be reliably embedded and extracted (Su et al.) ~ millions bits for 1000 users Prefer to trace as many colluders as possible instead of only tracing one in B-S code

Our Proposed Approach Overall: consider fingerprint encoding, embedding & detection Build correlated fingerprints in two steps Anti-collusion fingerprint codes resist up to K colluders any subset of up to K users share a unique set of code bits shared bits get sustained and used to identify colluders Use antipodal coded modulation to embed fingerprint codes via orthogonal spread spectrum sequences Jointly consider fingerprint detection and decoding

16-bit ACC for Detecting  3 Colluders Out of 20 4/17/2017 16-bit ACC for Detecting  3 Colluders Out of 20 User-1 ( -1,-1, -1, -1, 1, 1, 1, 1, …, 1 ) ( -1, 1, 1, 1, 1, 1, …, -1, 1, 1, 1 ) User-4 Extracted fingerprint code ( -1, 0, 0, 0, 1, …, 0, 0, 0, 1, 1, 1 ) Collude by Averaging Uniquely Identify User 1 & 4 Embed fingerprint via HVS-based spread spectrum embedding in block-DCT domain

Anti-Collusion Fingerprint Codes Simplified assumption: Assume fingerprint codes follow logic-AND operation after collusion K-resilient AND ACC code A binary code C={c1, c2, …, cn} The logical AND operation of any combination of up to K codevectors is distinct from the AND of any other combinations of up to K codevectors Example: {(1110), (1101), (1011), (011) ACC code via combinatorial design Balanced Incomplete Block Design (BIBD) Simple Example ACC code via (7,3,1) BIBD for handling up to 2 colluders among 7 users

Balanced Incomplete Block Design (BIBD) Construction example of (7,3,1) BIBD code X={1,2,3,4,5,6,7} A={123, 145, 246, 167, 347, 257, 356} (v,k,l=1)-BIBD is an (k-1)-resilient AND ACC Defined as a pair (X,A) X is a set of v points A is a collection of blocks of X, each with k points every pair of distinct points is in exactly l blocks # blocks Code length for n=1000 users: O( n0.5 ) ~ dozens-to-hundreds bits Shorter than prior art by Boneh-Shaw O( (log n)6) ~ millions bits 1 2 3 4 5 6 7 x

ACC Codes Under Averaging Collusion BIBD-based ACC codes under averaging collusion Can distinguish colluded bits from sustained bits statistically with appropriate modulation or embedding The set of sustained bits is unique with respect to colluder set

Colluder Detector Design: Two Approaches 4/17/2017 Colluder Detector Design: Two Approaches Hard Detection: Detect the bit values and then estimate colluders from these values Uses the fact that the combination of codevectors uniquely identifies colluders Everyone is suspected as guilty and each ‘1’ bit narrows down set Soft Detection: Possible candidates for soft detection: Sorting: Use the largest detection statistics to optimize likelihood function to first determine bit values, then estimate colluder set. Sequential: Iteratively update the likelihood function and directly identify the colluder set.

ACC Experiment with Gaussian Signals Soft decoding gives more accurate colluder identification than hard decoding Joint decoding and colluder identification gives better performance than separating the two steps Sequential colluder identification gives a good tradeoff between performance and computational complexity

ACC Experiments with Images 4/17/2017 ACC Experiments with Images 1, 2, and 3 colluder cases were performed using the Lenna image under both blind and non-blind detection. Embed fingerprints in perceptually significant DCT coeffs (Podilchuk-Zeng). The fingerprinted images had no visible distortion, PSNR of 41.2 dB. Colluded images were compressed using JPEG with QF 50%.

Summary Important to design anti-collusion fingerprint for multimedia 4/17/2017 Summary Important to design anti-collusion fingerprint for multimedia Collusion is a cost-effective attack against fingerprinting Anti-collusion fingerprint can allow us trace traitor and deter unauthorized information leakage Proposed anti-collusion fingerprinting for multimedia by combining code design and code modulation Anti-Collusion Codes developed using BIBDs use sustained bits to trace colluders code length is much shorter than prior Boneh-Shaw code Joint decoding and colluder identification gives better performance than separating decoding and colluder identification