# Fragile Watermarking of 3D Models in a Transformed Domain
## 2 Related Works  
The field of digital watermarking has seen a large development of methods for images and audio, but also the protection of 3D models has received attention from researchers. Several algorithms for robust (see Table 1) and fragile (see Table 2) watermarking of 3D models have been developed in recent years. Here, we report a list of the properties declared by the authors, along with their pros and cons.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Embedding Space** & **Verification Type** & **Pros** & **Cons** \\ \hline
[2] & Spread spectrum & Non-blind & \
\begin{tabular}{c} Watermark process as \\ matrix operation \\ \end{tabular} &
\begin{tabular}{c} Requires original for \\ detection, low quality \\ \end{tabular} \\ \hline
[3] & Spread spectrum & Blind & \
\begin{tabular}{c} Redundant watermark \\ embedding in sub-meshes \\ for improved robustness \\ \end{tabular} &
\begin{tabular}{c} Complexity in \\ computing eigenvectors \\ \end{tabular} \\ \hline
[4] & Spread spectrum & Blind &
\begin{tabular}{c} More efficient \\ eigenvalue decomposition, \\ more robustness \\ \end{tabular} & Low quality \\ \hline
[5] & \
\begin{tabular}{c} Coarse, low resolution \\ approximation \\ \end{tabular} & Blind & Pretty robust to attacks &
\begin{tabular}{c} Tampering detection relies \\ on a simple correlation \\ \end{tabular} \\ \hline
[6] & Vertices’ space & Non-blind & \
\begin{tabular}{c} Redundant watermark \\ embedding for robustness \\ \end{tabular} &
\begin{tabular}{c} Requires original for \\ detection, low quality \\ \end{tabular} \\ \hline
[7] & \
\begin{tabular}{c} Spherical harmonic \\ transform space \\ \end{tabular} & Blind &
\begin{tabular}{c} Embeds in the transform \\ space, robust \\ \end{tabular} & Low quality \\ \hline
[8] & \begin{tabular}{c} Vertex norms distribution \\ histogram bins \\ \end{tabular} & Blind & \
\begin{tabular}{c} Robust against \\ distortionless and \\ distortion attacks \\ \end{tabular} &
\begin{tabular}{c} Not applicable to very \\ small models and \\ vulnerable to center of \\ gravity alteration \\ \end{tabular} \\ \hline
[9] & \begin{tabular}{c} Sparse quantization index \\ modulation space \\ \end{tabular} & Blind & \
\begin{tabular}{c} Uses a neural network to \\ choose embedding vertices \\ \end{tabular} &
\begin{tabular}{c} Only robust to deletion \\ of vertices \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of related works on robust watermarking: main properties, pros, and cons.  
Our proposed method shares a number of features with the literature and differs substantially in others: the main and more significant difference is the embedding space, which is secret and allows an extra level of security, as it is unfeasible for an attacker to reproduce such a space. Most of the related works in the literature are actually robust watermarking schemes, while our method is an extremely fragile method whose watermark is broken by negligible alterations to the 3D models it protects. Similarly to [13], we modify the binary float representation of the vertices' coordinates, but our watermark is not directly inserted into them, as done in [13]. Moreover, the proposed method is immune to vertex reordering and can tolerate affine transformations to the model when these transformations are stored separately from the vertex coordinates in the output file format (such as done in Blender). Finally, similarly to [20], we use a genetic algorithm to compute a (quasi)optimal solution to the embedding problem, but again, our watermark is embedded into a secret space and not directly into the vertices' coordinates.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Embedding Space** & **Verification Type** & **Pros** & **Cons** \\ \hline