3d fragile watermarking techniques-3

8/8/2019 3d Fragile Watermarking Techniques-3

1/12

Computer-Aided Design 38 (2006) 11541165

www.elsevier.com/locate/cad

A public fragile watermarking scheme for 3D model authentication

Chang-Min Choua,b,, Din-Chang Tsenga

aInstitute of Computer Science and I nformation Engineering, National Central University, No. 300, Jungda Road, Jhongli City, Taoyuan, 320, TaiwanbDepartment of Electronic Engineering, Ching Yun University, No. 229, Cheng-Shing Road, Jhongli City, Taoyuan, 320, Taiwan

Received 14 October 2005; accepted 29 June 2006

Abstract

A public fragile watermarking scheme based on the sensitivity of vertex geometry is proposed for 3D model authentication. In the 3D fragile

watermarking embedding, slightly perturbing the positions of a subset of vertices is usually needed to keep them in some predefined relationship

with their neighboring vertices. Two problems frequently arise in the embedding stage: the causality problem and the convergence problem. The

causality problem arises while the neighboring relationship of a former processed vertex is influenced by the perturbing of its latter processed

neighboring vertices. The convergence problem means that the original model has been heavily distorted before some vertices reach the predefined

relationship. In this paper, we propose a multi-function vertex embedding method and an adjusting-vertex method to overcome these two problems.

The proposed method does not need the original model and watermarks for authentication; moreover, the key for extracting watermarks is relatively

smaller than that of previous works. For some artistic or technical models, sometimes it is very important to control the distortion ratio caused

by watermark embedding. Our method can control the average distortion by the keys used in watermark embedding. Experimental and analytic

results on various kinds of 3D models show the effectiveness of the scheme.c 2006 Elsevier Ltd. All rights reserved.

Keywords: 3D authentication; Digital signature; Fragile watermarking; Tamper detection

1. Introduction

With the explosive growth of the Internet and the

development of digital content designing and processing

techniques, many valuable materials can be represented in

digital form for exhibition and access via the Internet. Due

to the characteristic of easy duplication and modification of

digital content, it is necessary to develop a variety of digital

signature or watermarking techniques for various protection

purposes such as model authentication and ownership claiming.

Digital signatures are designed for the receiver of electronic

documents to verify the identity of the sender and tocheck the originality of the documents. The watermarking

schemes are usually designed for the sender to check the

copyright ownership (robust watermarking) or for the receiver

to verify the authentication of the received media (fragile

watermarking). The main difference between digital signature

Corresponding author at: Institute of Computer Science and InformationEngineering, National Central University, No. 300, Junda Road, Jhongli City,Taoyuan, 320, Taiwan. Tel.: +886 3 4227151x35202; fax: +886 3 4222681.

E-mail address: [email protected] (C.-M. Chou).

and watermarking techniques is that the former attaches a small

piece of information (the digital signature) transmitted with

the original documents whereas the latter embeds invisible

information (the watermarks) in the original media.Encryption techniques can be symmetric or asymmetric [1].

Generally speaking, asymmetric methods have better security

but are very computationally expensive when compared with

symmetric methods. A compensation scheme is to encrypt

the digital contents by a symmetric method and then encrypt

the symmetric key by an asymmetric method. A typical

digital signature scheme extracts a message digest from the

original document and then encrypts the message digest byan asymmetric method. The message digest can represent the

original document in such a way that two different message

digests will be generated for two different documents even if

they have only one bit of difference. The encrypted message

digest is attached to the original document and transmitted to

the receiver. Although all data types can be treated as binary

data files and encrypted by digital signature schemes, directly

applying digital signatures for large multimedia data sets is

still costly and computationally expensive [1,2]. Instead of

using digital signatures for all kinds of electronic documents,

0010-4485/$ - see front matter c 2006 Elsevier Ltd. All rights reserved.

doi:10.1016/j.cad.2006.06.009
http://www.elsevier.com/locate/cadmailto:[email protected]://dx.doi.org/10.1016/j.cad.2006.06.009http://dx.doi.org/10.1016/j.cad.2006.06.009mailto:[email protected]://www.elsevier.com/locate/cad


2/12

C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 11541165 1155

Table 1

A comparison of fragile watermarking and digital signature as applied to 3D

models

Functions Digital

signature

Fragile watermarking

Verify the identity of the sender Yes No

Check the integrity of the

documents

Yes Yes

Locate the changed regions No Yes

Implementation cost High Low

Computation speed Slow Fast

Application fields General Particular

researchers develop various watermarking schemes for various

multimedia data types such as video, audio, images, and

3D models. Watermarks can be invisibly/inaudibly embedded

in these media by altering some of their lower significant

bits. Watermarking schemes usually dont need any complex

computation (at most a FFT or wavelet transform [3] is used);

thus they can be performed in a fast and low cost way compared

with digital signature schemes.According to the application purpose, watermarking

techniques can be classified into robust and fragile schemes.

Robust watermarking is usually designed for ownership

claiming while fragile watermarking is used for digital content

authentication and verification. The design goal of robust

watermarking is to make the embedded watermarks remain

detectable after being attacked. In contrast, the requirements

of fragile watermarking are to detect the slightest unauthorized

modifications and locate the changed regions. According to the

extraction strategies of watermarks, watermarking schemes can

be classified into the private and the public approach. A private

watermarking scheme needs the original model and watermarkto extract the embedded watermarks while a public (or so-called

blind) scheme can extract watermarks in the absence of the

original model and watermark. On the other hand, a semi-

public watermarking scheme does not need the original model

in the watermark extraction stage, but the original watermark

is necessary for comparing with the extracted watermark.

The word public used in watermarking schemes is different

from that represented in cryptography schemes. All fragile

watermarking schemes are public, since it makes no sense

to use a private fragile watermark. Possible applications of

public fragile watermarking include demonstrating that digital

material has not been changed (or has been changed) in

an official situation (e.g., in a court) and to confirm the

received digital material has not been changed at the receiver

end. The functions of the 3D fragile watermarking scheme

are similar to that of a digital signature. Both schemes can

check the originality of the received 3D models. Digital

signatures can verify the identity of the sender while the 3D

fragile watermarking can locate the changed regions. Moreover,

for 3D models, the 3D fragile watermarking is superior to

the digital signature scheme in its easy implementation and

faster computation. A comparison of these two schemes is

summarized in Table 1.

In 3D fragile watermark embedding, slightly perturbing the

positions of a subset of vertices is usually needed to keep

them in some predefined relationship with their neighboring

vertices. Two problems frequently arise in the embedding

stage: the causality problem and the convergence problem. The

causality problem arises when the neighboring relationship of

a former processed vertex is influenced by the perturbing of its

later processed neighboring vertices. The convergence problem

means that the original model has been heavily distorted beforesome vertices reach the predefined relationship. In this paper,

we propose a multi-function vertex embedding method and

an adjusting-vertex method to overcome these two problems.

The proposed method does not need the original model and

watermarks for authentication; moreover, the key for extracting

watermarks is relatively smaller than that of previous works.

For some artistic or technical models, sometimes it is very

important to control the distortion ratio caused by watermark

embedding. Our method can control the average distortion by

the keys used in watermark embedding.

The remaining sections of this paper are organized as

follows. A brief review of the robust and fragile 3D

watermarking schemes is given in Section 2, where thecausality and convergence problems are also discussed. The

proposed watermarking embedding scheme is described in

Section 3; moreover, we illustrate how to examine the

originality of the received 3D model and how to locate the

changed regions by the proposed method. We discuss the

control of the distortion caused by the watermark embedding

in Section 4. In this section, a variant scheme which attaches

a watermark digest with the original model instead of

embedding watermarks in the original model is presented.

Finally, experimental results and concluding summaries are

provided in Section 5.

2. Previous work and problems

Watermarking techniques for still images have been

widely studied and investigated in recent years. On the

other hand, watermarking for 3D models gets relatively

less notice. Initially, Ohbuchi et al. [46] proposed a

large variety of techniques for embedding data into 3D

polygonal models. Benedens and Busch [7,8] embedded

private watermarks by altering 3D object with a normal

distribution. Their watermarking systems achieved robustness

against randomization of vertices, mesh altering (re-meshing),

and polygon simplification operations. Praun et al. [9] proposed

a sophisticated robust mesh watermarking scheme. They firstconstructed a set of scalar basis functions over the mesh vertices

using multi-resolution analysis [10] and then perturbed vertices

along the direction of the surface normal weighted by the basis

functions. Their watermarking scheme is resistant to common

mesh attacks such as translation, rotation, scaling, cropping,

smoothing, simplification, and re-sampling operations. These

above researches concentrated on 3D robust watermarking

techniques.

Yeo and Yeung are the pioneers for discussing 3D fragile

watermarking [11]. They computed two indices for every

vertex: the location index and the value index. For each vertex

v, the location index is calculated by a hash function according


3/12

1156 C.-M. Chou, D.-C. Tseng / Computer-Aided Design 38 (2006) 11541165

to the coordinates of it and its neighboring vertices, while the

value index is calculated by another hash function based on

its coordinates. Then they slightly perturbed every vertex to

make these two indices equal. Unauthorized modifications willbe detected in the watermark extraction phase by checking the

difference between these two indices. The scheme is both public

and fragile, but there are two disadvantages:(i) The causality problem: The location index of a former

processed vertex will be changed by the perturbing of

later processed neighboring vertices. As one example,

illustrated in Fig. 1, suppose we process vertices in the

order v0, v1, v2, . . . , vn , we first process and perturb v0to make its value index (calculated from its coordinates)

being equal to its location index (calculated from the

coordinates of it and its neighboring vertices). However,

the location index of v0 will be changed when we processand perturb v1 to adjust its value index. The same situation

occurred when the following vertices are processed. To

avoid the causality problem, we need to perturb vertices

in a predefined order (v0, v1, v2, . . . , vn) and constrain thecalculation of the location index for each vertex only to

involve the vertices that have been processed. For example,

in Fig. 1, the calculation of the location index of v0 should

only involve itself. The calculation of the location indexof v1 should only involve v0 and v1. The calculation of

the location index of v2 can only involve v0, v1 and v2,

and so on. This constraint can avoid the causality problem.

A drawback of this constraint is that the capability fordetecting modification will be ruined if the predefined

traverse order has been changed or became untraceable. For

example, a simple model simplification (vertex decimation)

or vertex re-numbering operation may totally disable thecapability of the scheme.(ii) The convergence problem: In the vertex perturbing stage,

it requires perturbing the vertices of the whole model to

make the value index and the location index of every vertex

equal. In practice, some vertices may need to be perturbed

more and more to satisfy the requirement as in the exampleillustrated in Fig. 2. In the figure, v0 has to be perturbed to a

position that heavily distorts the original structure to make

its two indices equal. It is possible that the requirement

is met only when the model has been heavily distorted orthe requirement can never be met. Another disadvantage

coming from the convergence problem is that the user can

not control the distortion induced by the perturbing process.

Fornaro and Sanna [12] proposed a public key approach

for authentication of Constructive Solid Geometry (CSG)

models. They computed watermarks from a model followed

by a watermark encryption operation and then attached theencrypted watermarks to the solids or comments of the CSG

models. The advantage of the method is that no modification

on the original 3D model is needed and this characteristic

is sometimes very important to some artistic or technicalmodels. The drawback of this scheme is that it can only tell

if a model has been modified, but can not locate the modified

regions. To locate modifications is an important issue in 3D

fragile watermarking.

Fig. 1. An example of the causality problem.

Fig. 2. An example of the convergence problem.

Lin et al. [13] proposed a scheme similar to Yeo and Yeungs

method [11]. Their method eliminates the causality problem by

applying two different hash functions on the vertex coordinates,

without considering the neighboring vertices of a vertex. In the

embedding stage, they slightly perturbed every vertex making

these two hash function values equal; however, the convergence

problem still occurs in this scheme. To avoid heavy distortion

due to vertex perturbing, they set a threshold and simply skipthe vertices that could not meet the requirement under the

threshold. This causes some embedding holes which cause

false-alarms in the watermark detection stage.

Wu and Cheung [14] proposed a fragile watermarking

scheme for authenticating 3D mesh models. The watermark

embedded by the method is invariant to translation, rotation,

and uniform scaling, but is sensitive to other operations.

The main idea of the method is to keep the ratio between

the distance from the mesh center to each surface face

and a quantization step remaining the same after the model

is translated, rotated, or uniformly scaled. There are two

major drawbacks in this scheme. Firstly, it is a semi-publicwatermarking scheme since the original watermark is needed

in the decoding stage to authenticate the watermarked model.

In fragile watermarking, a pure public watermarking scheme is

preferred since we dont want to pay extra cost for encrypting

the original watermark. Secondly, it fails in locating the

changed regions since the center position of the mesh will be

changed once any vertex has been changed. In our opinion, the

ability of locating the changed region is important for fragile

watermarking. However, their concept of invariant geometry

transformation is worth further study since the transformation

does not affect the integrity of the mesh. No other paper

discussing the topic has been published as yet.


4/12


Fig. 3. An overview of our watermark embedding and extraction schemes.

3. The proposed watermarking scheme

In the proposed watermarking scheme, two major methods,

the multi-function vertex embedding method and the adjusting-

vertex method, are proposed for 3D model authentication. An

overview of our watermark embedding and extraction schemes

is illustrated in Fig. 3.The multi-function vertex embedding method means that the

three coordinates of a mark vertex are assigned and embedded

with different functions of watermark in the watermark

embedding stage. At first, we select a set of mark vertices from

the original mesh model. The union of the selected vertices and

their neighboring vertices should cover the whole model. Thenwe modulate the x1 coordinate of each vertex to indicate if it

is a mark vertex. For mark vertices, we embed wi and h(wi )

into their x2 and x3 coordinates respectively. The embedding

needs to ensure all mark vertices satisfy the relationship of

hi = h(wi ) after watermark embedding, and this relationship

will be used for the authentication check in the extraction stage.In the watermark extraction stage, we examine a mesh model

by first checking the x1 coordinate of every vertex to see if

it is a mark vertex. Then for each mark vertex, we extract

the possible embedded information w and h from its x2 and

x3 coordinates respectively and examine if it can satisfy the

relationship h(w) = h

. For any mark vertex that can not hold

this predefined relationship, we set it and all its neighboring

vertices as suspicious vertices.

3.1. The watermark embedding scheme

Given a mesh M(V, C), where V is the vertex set and

C is the connectivity relationship on M, a watermark W =

(w1, w2, . . . , wn ) is embedded by inducing each wi with a

small displacement in a subset of V. A vertex v is noted asv(x1,x2,x3) or v

(x 1,x2,x

3) before or after embedding (or

say marking), respectively. The approach for embedding wi in

vertex v is as follows:

(i) The three coordinates of vertex v(x1,x2,x3) are defined

with different functions: x1 is used to indicate if v is a

mark vertex (i.e., v is a watermark embedded vertex), x2is used for embedding watermark wi , and x3 is used for

embedding h(wi ), where h is a predefined hash function

and is used for checking modification.(ii) For each vertex, its x1 value is divided by a factor k

w to

generate an integer. If v is a mark vertex, the integer must

be odd; otherwise, x1 is changed to x1 + kw . If v is a

non-mark vertex, the integer must be even; otherwise, x1is changed to x1 + k

w . That is,

m = x1

kw

mod 2 (1)


5/12


and

x 1 =

x1, if(m = 1 and v is a mark vertex) or

(m = 0 and v is not a mark vertex).

x1 + kw , otherwise.

(2)

(iii) For a mark vertex v, its barycenters of x2 and x3coordinates, x c2 and x

c3 , are calculated by averaging the

coordinates of its neighboring vertices,

x cj =1

|N(v)|

N(v)

xj , j = 2, 3, (3)

where N(v) is the set of vs neighboring vertices and

|N(v)| is the size of N(v). In this paper, we use the

barycenters of a vertex to represent the vertex features

calculated by Eq. (3).(iv) For a mark vertex v, its xj coordinate is slightly moved

toward x cj to the new locations xej such that |x

ej x

cj | are

divisible by kqj , j = 2, 3, respectively,

x ej =

xj (|xj x

c

j | mod k

q

j ), ifxj > xc

j ;xj + (|xj x

cj | mod k

qj ), otherwise.

(4)

(v) Finally, we employ kqj and k

dj to embed watermarkwi and

hash function value hi in xej ,

x j =

x ej + dj , ifxj > x

cj

x ej dj , otherwise, j = 2, 3, (5)

where d2 =k

q2

kd2wi , d3 =

kq3

kd3hi , hi = h(wi ), 0 < wi < k

d2 ,

0 < hi < kd3 , wi , hi , k

d2 , k

d3 N, and h is a predefined

hash function. The embedding perturbs x ej toward the

original value xj with a small displacement dj which is

always less than kqj , j = 2, 3.

kw , kqj , k

dj , and h will serve as the keys in the watermark

extraction stage.

The causality problem and the convergence problem arise

in the embedding stage when we embed watermarks through

the whole model. It is obvious that the barycenters (x2 and

x3 coordinates) of a former processed vertex will be changed

when any of its neighboring vertices was selected to be a

mark vertex too and need to be perturbed. We propose an

adjusting vertex method to overcome the causality problem.

The function of the adjusting vertex is to keep the barycenters

of the mark vertex unchanged. For each chosen mark vertex,

we randomly assign an adjusting vertex from its neighboring

vertices. In other words, a vertex is qualified to be a mark vertex

as long as it can find an adjusting vertex among its neighboring

vertices. Any mark vertex cant be taken as an adjusting

vertex and vice versa. To avoid the causality problem, the

neighboring vertices of the previously selected mark vertices

cant be taken as adjusting vertices for later mark vertices. This

constraint eliminates the causality problem but may leave a

few isolated vertices, which is a vertex wholly surrounded by

adjusting vertices. The isolated vertices will be treated as mark

vertices and be perturbed after all adjusting vertices having

been modulated. Most 3D fragile watermarking embedding

schemes perturb the positions of a subset of vertices to keep

them in some predefined relationship with their neighboring

vertices. The convergence problem arises when the original

model has been heavily distorted before some vertices reach

the predefined relationship. The use of the adjusting vertex

method guarantees that there is no endless perturbing while

embedding watermarks; thus there is no convergence problem

in the proposed method. The detailed watermark embeddingprocedure is given in Algorithm 1.

Algorithm 1 (The Watermark Embedding Algorithm).

for each vertex vi in the mesh model

{ vi .mark= False

vi .mark eligible = True

vi .adjusting eligible = True

}

set v1 as the active vertex, vactwhile (vact! = NULL)

{ ifvact is a mark eligible vertex and there is at least oneeligible adjusting vertex among vacts neighboring

vertices then

{ randomly select one eligible adjusting vertex vj from

vacts neighboring vertices as its adjusting vertexvact.mark= True

vact.mark eligible = False

vact.adjusting eligible = False

vj .mark eligible = False

for each vacts neighboring vertex vivi .adjusting eligible = False

calculate the x2 and x3 coordinate barycenters ofvactusing Eq. (3)

embed watermarks to vacts x2 and x3 coordinatesusing Eqs. (4) and (5)

}

elseifvact is surrounded by all adjusting vertices then

{ set vact as an isolated vertex

vact.mark= True

}

set the next vertex as the active vertex, vact (Traverse the

whole model)}


{ modulate vacts x1 coordinate according to its mark flag

using Eqs. (1) and (2)ifvact is a mark vertex then

make compensation perturbation on vacts adjusting

vertex using Eq. (6)set the next vertex as the active vertex, vact (Traverse the

whole model)}

for each isolated vertex vi in the mesh model

{ calculate the x2 and x3 coordinate barycenters ofviusing Eq. (3)

embed watermarks to vi s x2 and x3 coordinates using

Eqs. (4) and (5)}


6/12


Three flags are used in the algorithm to indicate the state

of each vertex in the mesh model: the mark flag indicatesif a vertex is a mark vertex or a non-mark vertex, the

mark eligible flag indicates if a vertex is eligible to be a markvertex, and the adjusting eligible flag indicates if a vertex is

eligible to be an adjusting vertex. Initially, all vertices are set

to be non-mark, mark eligible, and adjusting eligible vertices.Then we set v1 as the active vertex and traverse the whole modelstarting from v1 to select a set of mark vertices. Any traversal

algorithm works fine in this scheme as long as it can visit everyvertex exactly once. In our experiments, a simple breadth-first

search (BFS) algorithm is used for the mesh vertex traversal. Avertex is set to be a mark vertex if it is a mark eligible vertex

and there is at least one eligible adjusting vertex among itsneighboring vertices. We randomly select one eligible adjusting

vertex from its neighboring vertices as its adjusting vertexand then modify the related flags: set the active vertex as

a mark, non-mark eligible, and non-adjusting eligible vertex.The selected adjusting vertex is set as a non-mark eligible

vertex, and all active vertexs neighboring vertices are set asnon-adjusting eligible vertices. For each selected mark vertex,the barycenters of their x2 and x3 coordinates are calculated

using Eq. (3). Then we slightly perturb their x2 and x3coordinates to embed watermarks by using Eqs. (4) and (5).

A vertex that is surrounded by all adjusting vertices (i.e., anisolated vertex) is set to be a mark vertex. An isolated vertexs

mark eligible and adjusting eligible flags are not modifiedsince these two flags wont be checked anymore if a vertex

is surrounded by all adjusting vertices. Without adjustingvertices, the isolated vertices are watermarked after all their

neighboring adjusting vertices have been perturbed to preventtheir barycenters from being changed. Therefore, the isolated

vertices are not watermarked at this stage. The selection of markvertices will keep going till the end of mesh traversal.

After the mark vertices have been selected, we traverse themesh model again with the same order as the selection of the

mark vertices. During this iteration, we first modulate the x1coordinate of each vertex according to its mark flag using Eqs.

(1) and (2). The x1 coordinate will be used to indicate if a vertexis a mark vertex in the watermark extraction stage. Then we

make compensation perturbations on adjusting vertices,

x aj = xaj

N(mv)

(x j xj ), j = 2, 3, (6)

where xa2 and x

a3 are the second and third coordinates of the

adjusting vertex for a mark vertex v; N(mv) is the set of all vsneighboring mark vertices and adjusting vertices of previous

mark vertices. Lastly, we embed watermarks into all isolatedvertices using the same technique as we applied for other markvertices. The union of all mark vertices and their neighboring

vertices cover the whole model; thus we can detect any changeon the model. A brief proof of the coverage completeness is

given below.

Proof of coverage completeness: The union of all markvertices and their neighboring vertices cover the whole model.

Proof. Assume there is a non-mark vertex vi which is not

covered by any mark vertex; that is, it is surrounded by

adjusting vertices and other non-mark vertices. If vi is

surrounded by all adjusting vertices, it is an isolated vertex and

will be set as a mark vertex; otherwise, vi can pick a non-mark

vertex from its neighboring vertices to be its adjusting vertex,

and it will be set as a mark vertex. In both cases, vi can be set

as a mark vertex; thus, there is no such non-covered vertex vi .

3.2. The watermark extraction scheme and tamper detection

In the watermark extraction stage, kw , kqj , k

dj , and h serve

as the keys for malicious change detection. The detailed

watermark extraction procedure is given in Algorithm 2.

Algorithm 2 (The Watermark Extraction Algorithm).

set all vertices in the mesh model as non-suspicious vertices


{ Checkvacts x1 coordinate to see if it is a mark vertex

ifvact is a mark vertex then{ calculate the x2 and x3 coordinate barycenters of

vact using Eq. (3)extract w and h from vacts x2 and x3 coordinates

using Eq. (7)ifh(w)! = h then

set vact and all its neighboring vertices as

suspicious vertices}

set the next vertex as the active vertex, vact (Traverse the

whole model)}

Initially, all vertices of the mesh model are set to be non-

suspicious vertices. Then we set v1 as an active vertex and

traverse the whole model starting from v1 to examine the model.

We check if a vertex is a mark vertex by applying its x1coordinate and kw to Eq. (1). For each mark vertex, we first

calculate its x2 and x3 barycenters using Eq. (3), and then apply

its x2 and x3 coordinates, the barycenters, and kqj , k

dj to extract

the watermarks using the following equations,

w = (|x c2 x2| mod k

q2 )

kd2

kq2

h = (|x c3 x 3| mod kq3 )kd

3k

q3

.

(7)

Vertices that have not been changed will satisfy the

relationship, h(w) = h. On the other hand, a vertex that

does not satisfy the above relationship indicates that at least

one of its neighboring vertices or the vertex itself (or both) has

been changed. Thus, for any mark vertex that can not satisfy

this relationship, well set it and all its neighboring vertices

as suspicious vertices. There is no way for a forger to modify

a model and keeping the relationship unchanged without the

keys. Fig. 4 shows how our scheme detects modifications

and locates the suspicious modified regions. In Fig. 4(a), v

is a vertex that has been changed, and wi , i = 05, are


7/12


Fig. 4. A mesh with one vertex changed. (a) v is a vertex that has been changed

and wi , i = 05, are mark vertices. (b) Two mark vertices, w1 and w4, have

detected the change. (c) These two mark vertices and their neighboring vertices

are set to be suspicious vertices (linked by dashed lines). (d) Parts of suspicious

vertices are released by the undetected mark vertices (changed from gray to

non-gray nodes). In this figure, black nodes denote the mark vertices, white

nodes denote the non-mark vertices, and gray nodes denote the suspicious

vertices.

mark vertices. In Fig. 4(b), two mark vertices, w1 and w4,have detected the change, whereas other four mark vertices

dont. Fig. 4(c) shows that these two mark vertices and their

neighboring vertices are set to be suspicious vertices (linked by

dashed lines, shown as gray nodes). Then parts of suspicious

vertices are released by the undetected mark vertices (changed

from gray to non-gray nodes), as shown in Fig. 4(d). Lastly, we

can induce the possible modified vertices: v and/or w1.

4. Distortion control

In 3D models, the distance between two surfaces X and Y

can be defined as an L2 measurement [15],

d(X, Y) =

1

area(X)

x X

d(x, Y)2dx, (8)

where d(x , Y) is the Euclidean distance from a point x on

X to the closest point on Y. We modify the definition of the

L2 measurement to d(M, M) for representing the average

distortion of all vertices in a model:

d(M, M) =1

|M|

|M|i =1

|vi vi |, (9)

where M and M are the original and marked models,

respectively. In our scheme, the distortion induced by

Fig. 5. The distortion control analysis. (a) The chart ofkq versus the average

model distortion with various kws. (b) The chart ofkw versus the average model

distortion with various kq s.

watermark embedding depends on the x1, x2, and x3quantization steps: kw, k

q2 , and k

q3 . Key value k

w controls

the quantization step of x1 coordinate and key values kq2 and

kq3 control the quantization steps of x2 and x3 coordinates,

respectively. The setting of these three key values depends on

the desired average distortion. Fig. 5 shows how the averagedistortion d(M, M) is relative to these three parameters in the

Venus model. Fig. 5(a) is the chart of kq versus the average

model distortion with various kws; Fig. 5(b) is the chart of kw

versus the average model distortion with various kq s. For the

simplicity of discussion, we set kq2 = k

q3 = k

q for both charts

in Fig. 5. From these two charts, we can see that the less kw

and kq are, the less the distortion is. Thus the average distortion

caused by the watermark embedding process can be controlled

by setting appropriate kw and kq s. For example, suppose we

want to control the average distortion under 103, we may

reasonably set the key values of kw to be 103 and both kq s

to be 10

3.5 by observing the curves in Fig. 5(a) and (b).


8/12


Fig. 6. The steps of the watermark digest method.

For some artistic or technical models, it is sometimes

very important not to make any modification on the original

mesh models. We propose a variant scheme to satisfy this

requirement. In the variant scheme, a watermark digest (WD)

is calculated from the original model and then attached to the

original model for transmission. The WD consists of two parts

of information: wm and wp . The wm part records the indices

of the mark vertices while the wp part records the required

perturbing displacements of all mark vertices. The receiver

can perturb the received model according to the WD record

and then check the originality of the received model by the

method described in Section 3. This scheme is simple and the

original model need not be modified. To ensure security, the WD

needs to be encrypted. In other words, the WD plays the same

role as the message digest in the digital signature scheme.

Users can treat this method as a simple scheme for extracting

message digests from 3D models. Fig. 6 illustrates the idea of

this alternative method.

5. Experimental results and conclusions

We evaluated the proposed watermarking scheme on a set

of 3D models with various unauthorized attacks. Table 2 liststhe models used in our experiments. In these models, about

38%45% of vertices were chosen to be mark vertices. The key

values have to be carefully chosen since they directly influence

the average distortion of the marked models. The settings of kd2and kd3 depend on the range of embedded integer watermarks,

wi , and the hash function ofwi , h(wi ), respectively. According

to Eq. (5), kd2 has to be set greater than all wi and kd3 has tobe set

greater than all h(wi ). For example, if the selected set of integer

watermarks is in the range [0, n] and the hash function of this

watermark set is in the range [0, m], we may set kd2 = n + 1 and

kd3 = m + 1. The setting of key values kw and kq s depends on

the desired average distortion. Key values kw

and kq s directly

Fig. 7. One example of 3D fragile watermarking. (a) The original Venus model.

(b) The marked Venus model. (c) The marked Venus model changed by various

attacks simultaneously, where A denotes the region of invisible noise added,

B denotes the region of an extra vertex added, and C denotes the region of

some vertices deleted. (d) The detection results: the marked areas represent the

suspicious regions.

relate to the quantization steps ofx2 and x3 coordinates, thus the

smaller the key values are, the smaller the average distortion

is. Key values kds, which relate to the watermarks embedded

within each quantization step of x2 and x3 coordinates, have

no certain relationship to the average distortion. Table 3 lists

several experimental results of various models to illustrate the


9/12


Table 2

The list of models used in our experiments

Model name Number of vertices/faces Number of mark vertices Model

Apple 891/1704 343

Beethoven 2655/5028 1 022

Blade 24 998/49 992 10 320

Dinosaur 14 070/28 136 6 213

Horse 48 485/96 966 20 241

Pulley 25 482/50 964 10 402

Rocker-arm 10 044/20 088 4 142

Triceratops 2832/5660 1 132

Venus 8268/16 532 3 175

relationship between the setting of key values and the averagedistortion. The precision level is 104 for the original Venusmodel, and is 106 for all other original models in Table 3.As shown in Table 3, smaller key values will produce smaller

average distortion, but will increase the precision requirementof the marked model. Extra precision requirement will cause a

size overload of the marked model. Users should determine thetrade-off between a small average distortion and a small-sized

overload.Fig. 7 illustrates how a Venus model is watermarked and

the detected changes by our scheme. Fig. 7(a) shows theoriginal Venus model. The Venus model has 8268 vertices and

16 532 faces; 3175 vertices were chosen to embed watermarks.

Fig. 7(b) shows the same view of the marked model. These two

models are visually identical. Fig. 7(c) shows a marked Venus

model that has been illegally changed by various operations:

noising, vertex adding, and vertex deleting simultaneously.

The regions labeled A, B, and C denote the regions

of invisible noise added, an extra vertex added, and some

vertices deleted, respectively. The proposed scheme locates

these changed regions by setting all regions that can not hold

the predefined neighborhood relationship as suspicious regions.

Fig. 7(d) shows the detected suspicious regions with marks. In

this experiment, we tried to control the average distortion within

10

4. By observing the charts of Fig. 5, we set kw

= 10

4


10/12


Table 3

The average distortion of various models with different settings of key values

Model/Precision level of original

model

kw kq

2 kq

3 kd2 k

d3 Hash function Average distortion/Precision requirement of marked model

Blade/106

0.01 0.01 0.01 250 250 h(wi ) = wi 0.019382/105

0.001 0.01 0.01 250 250 h(wi ) = wi 0.018326/106

0.01 0.001 0.001 250 250 h(wi

) = wi

0.003973/106

0.001 0.001 0.001 250 250 h(wi ) = wi 0.002088/106

0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001982/107

0.001 0.0001 0.0001 250 2 50 h(wi ) = wi 0.000383/107

0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000192/107

0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000193/107

0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000215/107

0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000213/107

0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000019/108

Pulley/106

0.01 0.01 0.01 250 250 h(wi ) = wi 0.013444/105

0.001 0.01 0.01 250 250 h(wi ) = wi 0.012352/106

0.01 0.001 0.001 250 250 h(wi ) = wi 0.003285/106

0.001 0.001 0.001 250 250 h(wi ) = wi 0.001330/106

0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001222/107

0.001 0.0001 0.0001 250 2 50 h(wi ) = wi 0.000332/1070.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000136/10

7

0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000146/107

0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000146/107

0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000155/107

0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000014/108

Rocker-arm/106

0.01 0.01 0.01 250 250 h(wi ) = wi 0.014812/105

0.001 0.01 0.01 250 250 h(wi ) = wi 0.013800/106

0.01 0.001 0.001 250 250 h(wi ) = wi 0.003286/106

0.001 0.001 0.001 250 250 h(wi ) = wi 0.001266/106

0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001153/107

0.001 0.0001 0.0001 250 2 50 h(wi ) = wi 0.000323/107

0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000121/107

0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000130/107

0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000134/107

0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000143/107

0.00001 0.00001 0.00001 250 250 h(wi ) = wi 0.000013/108

Venus/104

0.01 0.01 0.01 250 250 h(wi ) = wi 0.013823/105

0.01 0.001 0.001 250 250 h(wi ) = wi 0.003250/106

0.001 0.001 0.001 250 250 h(wi ) = wi 0.001343/106

0.0001 0.001 0.001 250 250 h(wi ) = wi 0.001222/107

0.001 0.0001 0.0001 250 2 50 h(wi ) = wi 0.000326/107

0.0001 0.0001 0.0001 250 250 h(wi ) = wi 0.000125/107

0.0001 0.0001 0.0001 250 500 h(wi ) = 2wi 0.000134/107

0.0001 0.0001 0.0001 500 250 h(wi ) = 0.5wi 0.000132/107

0.0001 0.0001 0.0001 500 500 h(wi ) = wi 0.000141/107

and kqj = 10

5, j = 2, 3, to achieve the requirement. As a

result, the average distortion of the marked Venus model was

104.5. The value ofkdj was set to 256; thus all watermarks were

integers randomly generated in the range [0, 255]. A simple

hash function h(x) = x was used for the change detection.

For engineering/technical models with flat surfaces, distor-

tion control of the watermark effect on the flat surfaces is the

most important issue. Our scheme can control the watermark

effect with proper key value setting. Fig. 8 shows the marked

results of three engineering models with different key value set-

tings. We set kq2 = k

q3 = k

q for all models in Fig. 8. Fig. 8(a)

and (b) show that the surfaces of marked models Blade and

Pulley keep flat while the average distortion is around 103,

and become rugged while the average distortion is around 102.

Fig. 8(c) shows that the surface of the marked model Rocker-

arm stays flat when the average distortion is around 104, and

becomes rugged when the average distortion is around 103.

The precision levels of these three original models are all 10 6.

According to Table 3, if we want to keep these marked surfaces

flat, the precision level requirements of marked models Blade,

Pulley and Rocker-arm are 106, 106 and 107, respectively.

Users can set the key values according to their requirements of

precision level and visual effect of marked models. However,

for conservative users who do not want to make any change on


11/12


Fig. 8. The marked results of three engineering models with different key value settings in front and back views. (a) The Blade model with various levels of

distortion. (b) The Pulley model with various-level distortions. (c) The Rocker-arm model with various-level distortions.

the original models, we recommend they choose the alternative

watermark digest method instead of the direct watermark em-

bedding scheme.

Our scheme is superior in that the average distortion of the

marked models is under control by the user while the other

schemes may suffer from the distortion problem due to the

convergence problem. In addition, a relatively small key is

needed for watermark extraction in our watermarking scheme.

In Yeo and Yeungs work [11], three lookup tables each with256 binary entries (2563 = 768 bits) and two predefined hash

functions are needed to extract watermarks while the proposed

scheme needs only three floating-point numbers (kq2 , k

q3 , and

kw), two integers (kd2 and kd3 ) and a predefined hash function

for watermark extraction (32 3 + 16 2 = 128 bits). In both

schemes, the key size is independent of the size of the 3D mesh

model. Moreover, our scheme can detect the changed regions

and give a reasonable guess of unauthorized modifications. We

think the ability of locating unauthorized modifications is an

important issue in 3D fragile watermarking.

Fig. 9 shows an example of how our watermarking scheme

detects unauthorized modification and gives a reasonable guess

to the kind of change that has been added on the marked model.

Fig. 9(a) shows a marked Dinosaur model. The Dinosaur

model has 14 070 vertices and 28 136 faces. 6213 vertices

were chosen to embed watermarks. Fig. 9(b) shows a marked

Dinosaurmodel changed by cutting the end of its tail. Fig. 9(c)

shows the cutting plane and vertices on the cutting plane.

The mark vertices (black nodes) detected a modification since

their neighboring relations were changed. Fig. 9(d) shows these

detected mark vertices setting themselves and their neighboringvertices as suspicious vertices (turn to gray nodes). As a

result, these detected suspicious vertices roughly form a circle.

Two possible attacks are most likely to produce this situation:

cropping and vertex decimation. Thus, we may reasonably

suspect that a part of the Dinosaur model has been cut from

this circle (the cutting plane) or a part of vertices around this

circle has been decimated.

The main contributions of the proposed scheme are

summarized as follows: (i) The causality problem has been

overcome using the adjusting vertex method so that the traverse

order is not needed in the watermark extraction stage. (ii)

The adjusting vertex method eliminates the possible problem


12/12


Fig. 9. An example of detecting modification. (a) The marked Dinosaur model.

(b) The marked Dinosaur model changed by cutting the end of its tail. (c) The

cutting plane. (d) The circle formed by the suspicious vertices. In this figure,black nodes denote the mark vertices and white nodes denote the non-mark

vertices.

of endless perturbing on mark vertices. This concept can

effectively limit the distortion ratio caused by watermark

embedding. (iii) Different functions are defined for the three

coordinates of vertices so that multiple meaningful information

can be embedded in one vertex. This characteristic is helpful

for other 3D applications such as robust watermarking and

data hiding. (iv) The average distortion of the marked models

is under user control with proper key value setting. (v)

The proposed scheme can detect and locate all unauthorized

modifications even if various multiple illegal changes are madeon a model simultaneously. (vi) The proposed scheme is public

and a relative small key is needed for the watermark extraction.

(vii) A variant scheme which attaches a watermark digest

with the original model instead of embedding watermarks in

the original model is proposed. It can be treated as a simple and

easy implementation version of the digital signature scheme in

extracting a message digest from 3D models.

Acknowledgements

The authors thank the anonymous reviewers for their

valuable comments and suggestions which improved the

readability and quality of this paper. The Blade model was

provided courtesy of IMATI-GE/CNR by the AIM@SHAPE

Shape Repository. The Pulley model was provided courtesy of

INRIA by the AIM@SHAPE Shape Repository.

References

[1] Schneier B. Applied cryptography: Protocols, algorithms, and source code

in C. 2nd ed. New York: Wiley; 1996.

[2] Xie L, Arce GR. A class of authentication digital watermarks for secure

multimedia communication. IEEE Trans Image Process 2001;10(11):

175464.

[3] Barni M, Bartolini F, Piva A. Improved wavelet-based watermarking

through pixel-wise masking. IEEE Trans Image Process 2001;10(5):

78391.

[4] Ohbuchi R, Mukaiyama A, Takahashi S. A frequency-domain approach

to watermarking 3D shapes. Comput Graph Forum 2002;21(3):37382.

[5] Ohbuchi R, Masuda H, Aono M. Watermarking three-dimensional

polygonal models through geometric and topological modifications. IEEE

J Sel Areas Commun 1998;16:55160.

[6] Ohbuchi R, Takahashi S, Miyazawa T, Mukaiyama A. Watermarking 3D

polygonal meshes in the mesh spectral domain. In: Proc of the graphics

interface. 2001.

[7] Benedens O. Geometry-based watermarking of 3-D models. IEEE

Comput Graph Appl 1999;19:4655.

[8] Benedens O, Busch C. Towards blind detection of robust watermarks in

polygonal models. Comput Graph Forum 2000;19:C199208.

[9] Praun E, Hoppe H, Finkelstein A. Robust mesh watermarking. In: ACM

siggraph proc. 1999.

[10] Hoppe H. Progressive meshes. In: ACM siggraph proc. 1996.

[11] Yeo BL, Yeung MM. Watermarking 3D objects for verification. IEEE

Comput Graph Appl 1999;19:3645.[12] Fornaro C, Sanna A. Public key watermarking for authentication of CSG

models. Comput Aided Des 2000;32:72735.

[13] Lin HY, Liao HY, Lu CS, Lin JC. Fragile watermarking for authenticating

3-D polygonal meshes. IEEE Trans Multimedia 2005;7(6):9971006.

[14] Wu HT, Cheung YM. A fragile watermarking scheme for 3D meshes. In:

Proc the 7th workshop on multimedia and security. 2005.

[15] Khodakovsky A, Schroder P, Sweldens W. Progressive geometry

compression. In: ACM siggraph proc. 2000.

3d fragile watermarking techniques-3

Documents