NONADDITIVE GAUSSIAN WATERMARKING AND ITS APPLICATION TO WAVELET-BASED IMAGE WATERMARKING Pierre Moulin and Aleksandar Ivanovi´ c University of Illinois Beckman Inst., Coord. Sci. Lab & ECE Dept. 405 N. Mathews Ave., Urbana, IL 61801 E-mail: [moulin,ivanovic]@ifp.uiuc.edu ABSTRACT This paper extends our recent game-theoretic approach [1] to design and embed watermarks in Gaussian signals in the presence of an adversary. The detector solves a binary hy- pothesis testing problem. The system is designed to min- imize probability of error under the worst-case attack in a prescribed class of attacks. In this paper, the embedder is al- lowed to filter the host signal and add a watermark, thereby making the scheme nonadditive. The theory is applied to wavelet-based image watermarking. We find that, in this framework, additive watermarks are clearly suboptimal. 1. INTRODUCTION Applications of watermarking include copyright protection, document authentication, covert communications, and data embedding. In these applications, a watermark is embedded within a host data set such as text, audio, image, or video. This embedding should be nearly imperceptible and robust against possible manipulations of the watermarked data, in the sense that it should be possible to reliably extract the watermark in a degraded version of the signal. Degradations include operations such as addition of noise, filtering, com- pression, format conversion, and desynchronization. These degradations could be intentional (due to an adversary) or nonintentional (e.g., due to a lossy communication chan- nel). We extend recent work [1] on the detection-theoretic as- pects of the Gaussian watermarking problem in two ways: first, we enlarge the set of strategies for the watermarker to include signal scaling and filtering, and demonstrate sub- stantial advantages of such strategies; second, we apply the optimal embedding and attack strategies (which are the so- lution to a maxmin optimization problem) to wavelet-based image watermarking. WORK SUPPORTED BY NSF GRANTS CCR 00-81268 AND CDA 96-24396. Notation. We use capital letters to denote random vari- ables and small letters to denote their individual values. The cardinality of a set Ω is denoted by |Ω|. The Euclidean norm of a vector x is denoted by ‖x‖ =( ∑ n x 2 (n)) 1/2 . The multivariate Gaussian distribution with mean vector μ and covariance matrix R is denoted as N (μ, R). The mathemat- ical expectation of a random variable X is denoted EX . 2. MATHEMATICAL MODEL Let s(n),n ∈ Ω= {0, 1, ··· ,N 1 − 1}×{0, 1, ··· ,N 2 − 1} denote the original N 1 × N 2 digital image to be marked, taking values in R and modeled as a Gaussian random vec- tor N (0,R s ) whose components are indexed by n ∈ Ω.A watermark is inserted in s, resulting in a marked image x, that is made publicly available. The watermark is available at the detector, but s itself is not (blind watermarking). We assume that an adversary (attacker) takes x and produces a degraded image y. The decoder has access to y and k but not to s (blind watermarking), and must determine whether the watermark was embedded in x or not. Assume that the watermarker implements the linear op- eration: x = Φ(s + p), (1) where Φ is an |Ω|×|Ω| matrix and {p(n),n ∈ Ω}∼N (0,R p ) is a Gaussian random vector (thought of as a pattern) inde- pendent of s. We call w △ = x − s = (Φ − I )s +Φp the watermark; w depends on s unless Φ is the identity matrix, I . In this case, the watermark is said to be additive. The vector p is available at the detector and is independent of s by construction. The embedding is subject to a constraint on the average squared-error distortion: D w ≥ |Ω| −1 E‖X − S‖ 2 = |Ω| −1 Tr[(Φ − I )R s (Φ − I ) T +ΦR p Φ T ].(2) Assume the attacker implements the attack y =Γx + e, (3)