## 3 Proposed Multiple Watermarking Algorithm
### Watermark Embedding  
Spatial domain watermarking is when the watermarks are directly embedded in the coordinates of the vector graphic data. Generally, to increase robustness against common attacks, especially data cropping and the deletion of vertices, the same watermarks are usually repeatedly embedded into vector geographic data. That is, the same watermark bit may be embedded into different coordinates, generating robustness against vertex deletion attacks. Generally, common attacks include data addition and deletion. Data addition attacks involve randomly adding vertices to the watermarked data, while data deletion attacks remove vertices from the cover data. There are four types of data deletion attacks: deleting vertices (depicted in Figure 6), deleting features (illustrated in Figure 7), data cropping (illustrated in Figure 8), and data compression attacks. Deleting vertices involves randomly removing vertices from the watermarked data; deleting features means randomly deleting points, polylines, or polygons from the watermarked data; data cropping attacks involve selectively cropping regions of the watermarked data; and data compression attacks involve compressing the vector map with the watermark the Douglas-Peucker algorithm [PERSON] (1998). For vector geographic data organized as points, deleting vertices is the same as deleting features. The attack intensity corresponds to the number of vertices being processed divided by the number of original data. Figure 5: Relationships between the watermark, the watermark bit, and the watermark bit index. The proposed algorithm is based on the fundamental concept that watermark bits are repeatedly embedded in different coordinates using a \"one-to-many\" mapping between watermark bit indexes and coordinates. In other words, each watermark bit is embedded multiple times in various coordinates. Consequently, a single watermark bit index may correspond to several coordinates, enhancing robustness against vertex deletion attacks. Figure 9 illustrates the \"one-to-many\" relationship, while Equation (4) presents the embedding model. Figure 8: Cropping attacks. (**a**) Watermarked map and (**b**) watermarked map after being cropped. Figure 6: Vertex deletion attacks. (**a**) Watermarked map and (**b**) watermarked map after the deletion of vertices. Figure 7: Feature deletion attacks. (**a**) Watermarked map and (**b**) watermarked map after features are deleted. In Figure 9, there are four watermarks, watermarks 1, 2, 3, and 4, and the cover data that are composed of coordinate vertices. The watermark bits corresponding to the same index are embedded into a single coordinate:  
\[VC\oplus W=\left\{x_{j}\oplus w_{i}\big{[}f\big{(}x_{j},y_{j}\big{)}\big{]}\right\}, \tag{4}\]  
where \(VC\) refers to the cover data, \(W\) is a watermark, \(\big{(}x_{j},y_{j}\big{)}\) are the coordinates of the \(i\)th vertices, and \(f(\cdot)\) is the mapping relationship between the coordinate vertices and the watermark bit indexes. Moreover, in Equation (4), \(0\leq f(\cdot)<l\), where \(l\) is the length of the watermarks. \(\oplus\) is the method of watermark embedding, that is, the proposed multiple watermarking method using MQIM. The watermarks are embedded in the \(X\) coordinates. The whole flow for embedding the four watermarks is shown in Figure 10, and the specific embedding steps are followed. 1. Let the first quantization step size be \(s\), and the number of embedding watermarks be \(m\). The watermark index is initialized as 0, i.e., \(i=0\). 2. The index of the watermark bit is \(i=f\big{(}x_{j},y_{j}\big{)}\) for the vertices \(\big{(}x_{j},y_{j}\big{)}\). The index of the embedding watermark bit \(wb\) is \(w_{k}[i]\). 3. According to step \(s\) and the watermark index \(k\), the rules of the watermark bit \(wb\) embedding into the vertices are given in Equation (5): \[\left\{