## 6 Experimental Results
It is not wrong to state that, in case of a dispute for determining image ownership, the \"perfect looking\" image has good chances to be considered as the \"original\" one [53]. This is unlikely to happen in case of rotated or excessively compressed images. Besides signal processing operations and common attacks, we also executed comparative tests using a recently proposed watermarking scheme based on singular values [42] ([PERSON]'s scheme). We focused on this scheme only because it is based on the modification of the singular vectors as our watermarking scheme. We did not consider suitable to include in the comparative analysis the following algorithms:  
* the scheme proposed by [PERSON] et al. [40] due to the lack of information regarding the quality of the watermarked image (i.e., PSNR) and the test performed to demonstrate the robustness of the scheme;
* the scheme proposed by [PERSON] et al. [39], even if it is based on singular vectors, because of the detection problems analysed in various papers [29, 40, 41];
* the watermarking schemes based on singular values (SVs) since they are subject to the security and false positive problems, described in section 3. A discussion on the security of the watermarking schemes based on SVs is presented in C.  
The implementation of [PERSON]'s scheme is compliant with the idea presented in [42]. To correctly compare the methods we chose the parameters of the [PERSON]'s scheme so that the quality of the watermarked images was approximately 38 dB. The chosen values were:  
* the size of the test images equal to \(\,512\times 512\,\);
* a binary image of size \(\,32\times 32\,\) as watermark;
* the segmentation block size equal to \(\,8\times 8\,\);
* the threshold _th_ set to \(0.012\);  
The comparison test, presented in Table 3, was conducted by running both the embedding algorithms on 100 common images [58, 59] followed by the attacking and the extraction sessions. Given that both algorithms use different metrics for quantifying the detector response, we chose the percentage of the attacked images from which we were able to extract the watermark as a comparison factor. In Table 3, we refer to it as \"Detection Ratio\". The watermarking schemes were compared according to the essential requirements that must be satisfied by any marking system:  
Figure 4: The cropping attack performed on the 512\(\times\)512 “Lena” image: the watermarked image (left) and the same image with cropped border by 20% (right). * **Quality of the watermarked image**. Our scheme produces a perceptually good watermarked image (PSNR
* 38 dB) since it modifies the middle singular vectors in each block (i.e., the 6 th and 7 th right singular vectors). Differently from the [PERSON]'s scheme, which embeds the watermark into the first singular vector in each block, our method discards the first two couples of vectors to maintain the image quality as high as possible. * **Robustness against attacks**. From Table 3, it can be observed that the [PERSON]'s method performs well against cropping and row and column blanking/copying. Instead, when other attacks are applied, the detection ratio considerably decreases as the scheme fails to extract the watermark from all attacked images. Moreover, the [PERSON]'s scheme has worse performance compared to ours when JPEG compression and noise addition are applied and doesn't resist to down-sampling and gamma correction attacks. In our opinion this behavior is due to the way the watermark is embedded into the cover image, i.e., the orthogonality property of the singular vectors is not maintained in the embedding process. On the contrary, preserving such a property allows our scheme to detect the watermark from all attacked images, except when JPEG compression with quality factor 60 is applied (but still having a detection ratio equal to 94%).