1. Blind Pattern Matching Attack on Watermark Systems D. Kirovski and F. A. P. Petitcolas IEEE Transactions on Signal Processing, VOL. 51, NO. 4, April 2003

2. Outline Introduction The blind pattern matching attack (BPM) –Notations –Attacking steps –Attacking parameter determination BPM attacks for spread-spectrum watermarking and quantization watermarking of audio signals Conclusions

3. To Attack Digital Watermarking Main types of attacks –To remove the watermark Estimating the unmarked cover signal –Median filters Collusion attacks for fingerprinting –To prevent the detector from detecting the watermark Geometric distortions

4. The BPM Attack An attack aims to reduce the correlation of a watermarked signal with its watermark by replacing blocks of samples of the marked signal with perceptually similar blocks that are either not marked or marked with a different watermark

5. Attacking Strategy 1.Partition the content into overlapping low-granularity signal blocks 2.Identify subsets of perceptually similar blocks 3.Randomly permute their locations in the signal

6. Search Space If the number of blocks that have perceptually similar counterparts within the media clip is small, the adversary can seek replacement blocks in an external multimedia library Even without external replacement, watermark detector faces a task of exponential complexity to reverse the permutation

7. Block Sizes The adversary needs to reduce the granularity of integral blocks of data such that no block contains enough information from which a watermark can be identified individually –Blocks considered for BPM must at least one order of magnitude smaller than watermark length Audio: 128-1024 coefficients Video: 64x64 pixels

8. Notations Host signal Watermark Marked signal The BPM attack is not limited to certain signal model. The Gaussian assumption facilitates further analysis. e.g. in spread-spectrum watermarking,

9. Attacking Concerns Signal partitioning Similarity function –Determining the lower bound of similarity Pattern matching Block substitution

10. Signal Partitioning The watermarked signal is partitioned into n overlapping blocks. Each block B p represents a sequence of m samples starting at Why overlapping? –Consecutive blocks may lack perceptually similar characteristics :the overlap ratio

11. Similarity Function The quadratic Euclidean distance between blocks are used:

12. Pattern Matching Perceptual similarities between individual blocks are identified by a symmetric similarity bit-matrix S: The upper bound preserves fidelity, the lower bound is required since a block of exceptional similarity will not affect watermark detection if otherwise :parameters that denote the minimal and maximal average similarity

13. Determining the Lower Bound (1/2) In the SS watermark detector –The watermark w is detected in the signal z by matched filtering If z has been marked with w Otherwise Detection threshold

14. Determining the Lower Bound (2/2) Now assume the vector x+w is similar to and replaced by y+v if

15. Block Substitution 1.Copy 2.Marked all blocks as unvisited 3.Find unvisited Block B p 4.Let G p be a set of indices, s.t. 5.Let L p be a random permutation of elements of G p 6.Reorder blocks of with G p according to L p 7.Marks all blocks in G p as visited 8.Go to Step 3.

16. Experimental Results Test BPM attacks for audio contents watermarked with spread-spectrum and quantization index modulation schemes –For the SS scheme, within a 30s audio clip, the attack creates approximate 4 to 5 dB noise and brings the SS correlation detector to half the expected value without attack –Similar adversary effects can be obtained for the QIM detector

17. Remedies against the BPM Attack Identifying rare parts of the content and marked these parts only –Reducing the practical capacity and increasing the embedding complexity Longer watermarks and increased detector sensitivity –Very-long watermark sequence and lower robustness against other attacks