# Robust Signature-Based Copyright Protection Scheme Using the Most Significant Gray-Scale Bits of the Image

Authors: Mohammad Awrangjeb
Journal: Advances in Multimedia
 (2012)

---

## Abstract

Themost significant bit- (MSB-) plane of an image is least likely to change by the most signal processing operations. This paper presents a novel multibit logo-based signature, using the most significant gray-scale bits, which is then used to develop an extremely simple but robust copyright protection scheme, where images along with their signatures are sent to a trusted third party when a dispute arises. Different ways of processing the MSB-plane before calculating the robust signature have been developed. This paper then presents an innovative classifier-based technique to test the robustness and uniqueness of any signature-based scheme. A new MSB-based attack, which would defeat our scheme most, has also been proposed. Experimental results have clearly demonstrated the superiority of the proposed scheme showing the high robustness of different MSB-based signatures over the existing signature-based schemes.


---

## Body

## 1. Introduction

For last few years, we have been using electronic commerce that includes online and offline distribution of multimedia data like images, audios, and videos. However, digital multimedia files can be easily manipulated using commercial graphics tools. Duplicating digital files has become as simple as clicking a button. Since maintaining an exact or manipulated duplicate of any digital data is easier than before, the enforcement of copyright protection has become more imperative than ever. Although copyright laws are being applied against abusers in order to ensure secure electronic commerce, the current problems with copyright protection obstruct the rapid evolution of computer and communication networks. As a result, the enhancement and further development of digital copyright protection is in central to the development of future communication networks [1]. There may be three types of solutions to the copyright protection problem: cryptographic tools, digital watermarking techniques, and digital signature-based techniques.Cryptographic tools [2] can be used to encrypt a multimedia file using some secret key. The encrypted file is no more perceptually understandable and can be distributed to the users. Only the appropriate user that holds the secret key can decrypt and use this file. Such a technique while suitable for text documents is not suitable for multimedia data for the following two reasons. First, multimedia file size is much larger than that of text. Therefore, encrypting or decrypting a multimedia file is highly time consuming. Second, the encrypted media file is not useful in the public domain, for example, in the Internet. Because the encrypted file is not perceptually understandable and if the encrypted information is decrypted once, the information is no longer protected. However, the multimedia file provides an opportunity that the text document does not. That is, while no distortion is allowed in the signed text, some distortions are allowed in the signed multimedia file as long as it is perceptually similar to the original file.Digital watermarking techniques take the opportunity of the abovementioned property of the media file. They embed a watermark such as logos, seals, or sequence numbers, into the original image. The embedded watermark should survive against both malicious and nonmalicious attacks depending on the applications. Latter, the embedded information is extracted from or detected in the watermarked image in order to verify the ownership [3–11].Any watermarking technique should satisfy a number of essential properties [1, 5, 6]. However, many of the existing techniques do not satisfy some of the properties and, therefore, may not be applicable to build a proper copyright protection system [1, 8, 9]. They always distort the original image that might not be acceptable in some applications like medical imagery, law enforcement, and astrophysics research [7]. The amount of distortions increases with the increase of the embedding strength which though increases the chance of the survival of the watermark under different signal processing attacks. Some attacks like geometric distortions, collusion, and copy (averaging) attacks still challenge the robustness property. The watermark can also be removed using denoising [9]. Multiple watermarking (buyer’s and seller’s watermarks) in a single media is also problematic, since previous embedded watermark cannot be guaranteed to survive after the embedding of next watermark. Publicly verification of watermarking is another unsolved problem.Digital signature-based copyright protection schemes [1, 12–15] combine the advantages of both digital watermarking and cryptographic solutions. This technique, in general, calculates a digital signature using a logo and the extracted features from the original image (see Figure 1). The signature may then be protected using cryptography and certified by a trusted third party (TTP). Later, the signature is used to retrieve the logo from the test image. The retrieved logo is compared with the original logo using some similarity measurement function and a decision is made based on a threshold.Signature-based scheme using logo: (a) signature calculation and (b) logo retrieval operation and verification.
(a)(b)The reason of using a logo as a watermark [16] or to calculate signature [1, 12–15] is because it is a true representative of a company, an owner, or a customer. In the verification phase, in addition to “yes” or “no” answer based on the threshold, logo-based copyright protection schemes also allow perceptual recognition of the logo. Watermarking techniques embedding logos [16] mainly embed small binary logos and are unable to use large multibit (e.g., gray-scale) logos due to limited embedding capacity. However, large multibit logos are more practical and offer greater security than small binary logos. In contrast, signature-based schemes may calculate signature using any type (e.g., binary, gray-scale) and size of logos. There are also other signature-based schemes [17, 18], which do not use logos.There are many advantages of signature-based schemes over watermarking techniques. They cause no visual quality degradation to images as they do not embed any information. They offer cryptographic security and can sign any sizes of logos. They resolve multiple ownership claims by adding timestamp with the signature. They can use both buyer and seller logos while calculating the signature, thus providing practical usefulness of the copyright protection system in the network world. They can use any multibit logos that offer greater opportunity to survive than binary logos. In addition, they allow public verification when the signature is generated using public key cryptographic infrastructure.Katzenbeisser [19] argued that watermarking alone is not sufficient to resolve rightful ownership of digital data; therefore, a protocol relying on the existing cryptographic tools is necessary. Macq et al. [20] mentioned that watermarking along with registration authorities and transaction certifications are essential for digital right management of Internet distributed images. The signature-based schemes along with cryptographic tools can be considered as the complementary to the watermarking techniques to design a proper digital right management system.In this paper, we propose a computationally inexpensive signature-based gray-scale image copyright protection scheme intuitively using themost significant bit- (MSB-) plane (MSB-based scheme), which is least likely to change by any image processing operation. The MSB-plane of an image can be chosen in different ways before calculating the signature using the bit-planes of the logo: (i) directly choosing the MSB-plane at a region-of-interest (ROI), (ii) choosing the MSB-planes of textured blocks, (iii) choosing the MSBs of DC coefficients of the MSB-plane, and (iv) choosing the MSB-plane after t-scale wavelet decomposition. Besides being image size invariant, the proposed scheme can be used with any n-bit logo. In order to prove the robustness and the uniqueness of this scheme, we also present a novel idea of finding a classifier to separate logo retrieval instances of attacked images with the original signature against all other possible alternatives. To avoid any bias, we further propose a new MSB-based attack, which would defeat our scheme most. We then present a comprehensive TTP management policy that uses classifier-based thresholds in order to minimize false alarms. Experimental results not only reveal very high logo retrieval rate and visual quality of the retrieved logos by the proposed scheme against those by the existing schemes [12, 13] that also use multibit logos but also show the weakness of the latter as they fail to produce any classifier as discussed above. Note that the proposed signature-based scheme along with some preliminary results was published in [21].The rest of the paper is organized as follows: Section2 presents the previous signature-based schemes using logos; Section 3 describes why we have chosen MSB bit-plane for the proposed scheme; Section 4 presents the proposed scheme; Section 5 presents the experimental results and then compares the proposed scheme with the existing schemes; finally Section 6 concludes the paper with future research directions.


## 2. Previous Works

Lee and Chen [13] calculated the signature of an image with a gray-scale logo using vector quantization (VQ) on the coarse scale of the image obtained by a t-scale wavelet transform. The scheme is publicly verifiable and robust to a wide variety of attacks. However, it is weak to high lossy compression and geometric distortions. It cannot calculate signature if the type of the logo and the image is different, for example, binary logo and gray-scale image. The size of the coarse image reduces exponentially as t increases. Compounded with the approximation due to VQ, this can potentially lead to a very poor quality of the retrieved logo, especially when the original image size is small as demanded by the WWW. Chen et al. [1] later extended this idea for binary logos by replacing VQ with a polarity table. However, uniqueness of the signature, where it should verify the corresponding image only, may not be guaranteed with binary logos.Chang et al. [14] calculated signature with a gray-scale logo using torus automorphism functions. To survive in cropping attacks, the idea of using a rectangular region-of-interest (ROI) in the image was introduced in [12]. This technique can be used for cartoon graphics and survives on repainting. Nevertheless, it still cannot survive in high lossy compression and geometric distortions. It also cannot calculate signature if the type of the logo and the image is different, for example, binary logo and gray-scale image.The scheme in [15] used visual secret sharing technique to calculate signature using binary logos. It offers cryptographic security and allows generating meaningful share. It also allows multiple owners to share the same image. However, robustness depends on the sorting algorithm; that is, if the image is modified moderately, the sorting algorithm may result different share. Consequently, it cannot survive in high JPEG compression and small geometric distortions.All the above existing schemes offer very high time complexity. The time complexity increases, due to use of VQ encoding [13], torus automorphism [12, 14], permutation [1], or visual cryptography [15], with the increase of image size. Some of the above schemes [1, 13] incorporate digital signature including timestamp with the published image allowing public verification. Nonetheless, they increase the file size and the risk of losing copyright if the signature is removed from the header accidentally or intentionally.


## 3. Why the Most Significant Bit?

The MSBs are least likely to change by any image processing operation, for example, JPEG compression, filtering, and so forth. However, watermarking techniques cannot embed the watermark in the MSB-plane of an image. Because changes to MSBs introduce higher noticeable distortions. In the following experiments, we observed that the robustness of the MSB-based digital signature would be very high.We conducted experiments on a large database of 1032 images [22], including the benchmark ones [23]. In each case, we measured the MSB similarity rate, which means the percentage of MSBs that remain unchanged under the attack. Figure 2(a) shows that on average more than 91% of the gray-scale MSBs remained the same even when JPEG quality was set at the minimum; while more than 88% of the MSBs remained unchanged if the image is rotated by no more than ±5°. We further observed that under median filter, histogram equalization, salt and pepper noise, and Gaussian noise attacks on average more than 97%, 80%, 97%, and 90% of MSBs, respectively, remained unchanged, as shown in Table 1. In addition, we also tested the MSB similarity rate in the following four cases: (i) the MSB-plane at an ROI, (ii) the MSB-planes of textured blocks, (iii) the MSBs of DC coefficients of the MSB-plane, and (iv) the MSB-plane after 4-scale wavelet decomposition. Table 1 shows that histogram equalization and rotation attacks changed more MSBs than filtering and noising attacks. In StirMark attacks [24] like small random distortions, first three cases kept more than 80% MSBs unchanged and 4-level wavelet decomposition case is the most sensitive to these attacks. We will discuss how the MSBs were extracted in these four cases in Section 4.1.Table 1
Most significant bit (MSB) similarity rate under different attacks.
AttacksPSNR (dB)MSB similarity rate (%)MSB-planeROI1Text blocks2DC of MSB3DWT(t=4)4Average filter528.2396.495.696.096.399.6BPM (25 dB)22.9489.091.085.089.497.0Gauss. (G) filter536.9998.898.699.098.8100G filter5 & noise20.1990.289.485.089.598.2G noise20.4090.889.885.089.398.2Histogram equal.16.5180.079.092.484.380.8JPEG (quality 0)22.8790.890.087.087.394.2JPEG (quality 5)25.1393.892.691.093.396.0JPEG (quality 10)27.4995.494.694.096.598.6LSRD620.1685.088.075.088.792.0Median filter529.6597.496.698.097.399.4Motion filter526.0295.294.292.095.598.8MSB (30 dB)30.0081.075.075.079.693.0MSB (35 dB)35.0085.086.082.089.298.0Rot.-crop (2°)17.1588.088.681.093.589.6Rot.-scale (2°)14.1884.486.075.089.885.6Salt and pepper17.9597.897.498.096.898.0Self similarities26.0490.095.090.090.299.0Small rand. dist.16.2783.083.080.087.075.0unZign29.0897.097.096.099.7100Wiener filter534.6197.897.698.097.81001Region-of-interest.2512 textured blocks 8×8 were chosen from each image.3MSB-plane was divided into 8×8 blocks before taking DCT.44-level wavelet decomposition.53×3 window.6Latest small random distortion.(a) Most significant bit (MSB) similarity rates of gray-scale image at different JPEG and rotation attacks; (b) mean and standard deviation of gray-scale MSB similarity under the newly proposed MSB attack. Note that the rotation angle axis in (a) is nonlinear.
(a)(b)In order to avoid any bias, we now propose a new attack, namely, the MSB attack, where for a given target image-quality, inpeak-signal-to-noise ratio (PSNR), the maximum number of gray-scale MSBs are changed. We sort the pixels in an array in the ascending order according to their differences with the mid-gray value. Then, the MSB of the pixel with the lowest difference is flipped first and the entry for that pixel in the sorted list is taken out. This operation is continued until a certain PSNR is obtained. Figure 2(b) shows that on average more than 80% of the MSBs, with no more than 10% standard deviation, remained unchanged at 30 dB target PSNR, below which the visual quality of the image is unacceptable to the human eyes [13]. Table 1 also shows that in above four cases, on the average 85% MSB remained the same at 35 dB target PSNR, and among these cases 4-level DWT decomposition left most of the MSBs unchanged.From Figure2 and Table 1, it is observed that even when the images are distorted to a limit where the PSNR becomes as low as 15 dB to 30 dB, the majority of the MSBs still remain the same. This is because in signal processing attacks (JPEG, filtering, etc.), image pixels do not change their locations and thus majority of the MSBs do not change. On the other hand, in geometric attacks (rotation, scaling, etc.) image pixels change their locations and thus the MSB similarity rate drops even in small rotation angle change. In the case of high geometric distortions, it is possible to estimate the transformation parameters first [25] and then to reverse the transformation before using the MSBs for signature calculation.


## 4. Proposed Scheme

The proposed MSB-based scheme first selects a set of MSBs from the image and then calculates digital signature of an image for a logo. The signature is certified by the TTP. When a dispute arises between two images of two parties, both parties send their certified signatures and images along with their corresponding parameters to the TTP to judge.


### 4.1. Selecting the MSBs

The MSBs can be selected in different ways. In this section, we discuss four of them.Consider ann-bit gray-scale image I={ib(x,y)} of size wI×hI pixels where  1≤x≤wI, 1≤y≤hI, and 1≤b≤n. Similarly, consider an n-bit gray-scale logo L={lb(x,y)} of size wL×hL. Depending on the different ways of pre-processing the MSB-plane of the image, the MSB-based scheme may be named as different approaches.(i)
UROI. The MSB-plane at an ROI of the image is chosen directly. Notice that an ROI can be user defined and can be located using reference points, for example, corners [26].(ii)
TBLK. The MSB-planes of textured blocks at the ROI are chosen. We select8×8 textured blocks from the image using the technique represented in [7]. The MSB-planes of the selected textured blocks are accumulated as a single MSB-plane, where textured blocks are first taken in row-wise and then in column-wise.(iii)
DCTMSB. We can choose the MSBs of DC coefficients of MSB-plane. We divide the MSB-plane into8×8 blocks before taking DCT. Then we take the MSB of DCT coefficients in original space order (without sorting them).(iv)
t-DWT. The MSB-plane of LLt after t-scale wavelet decomposition of the original image is chosen.


### 4.2. Signature Calculation

LetMI={mj}, where 1≤j≤z, be the collective set of MSBs selected from I using one of the above approaches. Without any loss of generality, it is assumed that (1)z≥nwLhL.
The signature SI of I for L with MI is thus calculated as(2)SI(j=(b-1)wLhL+(y-1)hL+x)=mj⊕lb(x,y).
If the generality assumption in (1) cannot be met, mj’s  could be reused iteratively once exhausted. Moreover, any color image can be signed using its gray-scale equivalent with even a colored logo after stripping it into three gray-scale channels. Once the signature is calculated, the owner sends the following message, in the form of a triplet, to the TTP using public key cryptography:(3)MOT=ET,PUB(EO,PRV([I,SI,AI])),
where ET,PUB and EO,PRV are the public and private key encryptions of the TTP and the owner respectively and AI contains information about the MSB selection approach. On receiving the above message from the owner O at time TS, the message is first decrypted to receive the signature triplet as follows: (4)[I,SI,AI]=DO,PUB(DT,PRV(Msg)),
where DO,PUB and DT,PRV are the public and private key decryptions of the owner and the TTP, respectively. The TTP verifies SI for I using AI, appends timestamp TS, and sends back the following message to the owner:(5)MTO=EO,PUB(ET,PRV(SI||TS)),
where EO,PUB and ET,PRV are the public and private key encryptions of the owner and the TTP, respectively. The owner decrypts the above message with his private key as(6)SIc=ET,PRV(SI||TS)=DO,PRV(M2),
where DO,PRV is the private key decryptions of the owner. We name SIc as the certified signature for the image I.


### 4.3. Signature Verification

When a dispute arises for two imagesIi and Ij between two persons P1 and P2, they send the following messages claiming the ownership to the TTP:(7)MP1T=ET,PUB(EP1,PRV(Ii,L1,SIic,AIi)),MP2T=ET,PUB(EP2,PRV(Ij,L2,SIjc,AIj)),
where EP1,PRV and EP2,PRV are the private key encryptions of P1 and P2, respectively. The TTP decrypts the above messages as(8)[Ii,L1,SIic,AIi]=DP1,PUB(DT,PRV(MP1T)),[Ij,L2,SIjc,AIj]=DP2,PUB(DT,PRV(MP2T)),
where DP1,PUB and DP2,PUB are the public key decryptions of P1 and P2, respectively. The TTP then decrypted the certified signatures SIic and SIjc with its public key; this ensures the certificates have been issued by the TTP and the timestamps have not been changed afterwards their generation:(9)SIi‖TSi=DT,PUB(SIic),SIj‖TSj=DT,PUB(SIjc).
The TTP recalculates the signatures SIi and SIj and compares with the existing ones. This check ensures that encrypted signatures SIjc and SIjc have been generated for images Ii and Ij, respectively.


#### 4.3.1. Finding Disputable Images

LetL=S-1(I,SI,AI) denote the logo retrieval operation using the inverse process in (2) (see Figure 1(b)). The TTP has to confirm whether images Ii and Ij are disputable before taking a final decision based on the timestamps TSi and TSj. Two images are disputable if they are the same image or one is an attacked version of another. To do that the TTP executes the following two test cases: (10)TC1=S-1(Ii,SIj,AIj)∣S-1(Ij,SIj,AIj),TC2=S-1(Ij,SIi,AIi)∣S-1(Ii,SIi,AIi),
where the logo retrieved from Ii using signature and feature of Ij is compared against the logo of P2, and vice versa. If the logo retrieval rate (LRR), which is the percentage of unchanged bits, and the PSNR (with respect to original logos L1 and L2) of above two test cases TC1 and TC2 are above certain identification thresholds (ThLRR, ThPSNR), then the images are considered as disputable.


#### 4.3.2. Verification

IfIi and Ij are proved to be disputable, then the TTP compares timestamps TSi and TSj. The image is authenticated for P1 if TSi<TSj or for P2 if TSi<TSj.


### 4.4. Estimating Identification Thresholds

To avoid the risk of error due to arbitrary selection of identification thresholds (ThLRR, ThPSNR), we propose the following innovative classifier-based threshold estimation technique, which can also be used to test the robustness and uniqueness of any signature-based scheme. The lower the value of (ThLRR, ThPSNR), the lower the scheme is robust.LetTD={[Ii,SIi,AIi]} be a large image training database and let Bi={Ii(j)} be a set of attacked images from Ii for all i. Let(11)TC(a,b,c,d,j)=S-1(Ia(j),SIb,AIc)∣S-1(Id,SId,AId)
be a test case where the logo retrieved from the jth attacked image of Ia using the signature of Ib and the feature of Ic is compared against the logo used to sign Id, 1≤a,b,c,d≤|TD|, and 1≤j≤|Ba|. Let the positive (C+) and negative (C-) classes be defined as(12)C+={∀a,∀j:TC(a,a,a,a,j)},C-={∀a,∀b,∀c,∀d,∀j:TC(a,b,c,d,j)}-C+.
Note that the LRR and PSNR of all the test cases in (C+) should ideally be significantly higher than those in (C-). Any efficient classifier can now be used to separate the positive and negative classes based on the LRR and PSNR of all the test cases and the values of (ThLRR, ThPSNR) can then be estimated synergistically from this classifier.


### 4.5. Robustness and Uniqueness Tests

The identification thresholds (ThLRR, ThPSNR) defined in the previous section is useful for determination of robustness and uniqueness properties of a scheme. A scheme is not robust to a particular attack if the logo retrieved from the corresponding attacked image offers low PSNR and LRR with respect to (ThLRR, ThPSNR). In that case, the corresponding (PSNR, LRR) entry in C+ causes a false negative alarm by the classifier. We need to consider all the tests cases of C+, as defined by (12), in robustness tests. On the other hand, a scheme fails uniqueness test to a particular attack if the signature calculated from image Id verifies the corresponding attacked version of a different image Ia. In that case, the corresponding (PSNR, LRR) entry in C-, as defined by (12), is high with respect to (ThLRR, ThPSNR) and causes a false-positive alarm by the classifier. Therefore, we need to consider only the following test cases of the class C- in uniqueness tests:(13)C-′={∀a,∀d≠a,∀j:TC(a,b,c,d,j)}.


## 4.1. Selecting the MSBs

The MSBs can be selected in different ways. In this section, we discuss four of them.Consider ann-bit gray-scale image I={ib(x,y)} of size wI×hI pixels where  1≤x≤wI, 1≤y≤hI, and 1≤b≤n. Similarly, consider an n-bit gray-scale logo L={lb(x,y)} of size wL×hL. Depending on the different ways of pre-processing the MSB-plane of the image, the MSB-based scheme may be named as different approaches.(i)
UROI. The MSB-plane at an ROI of the image is chosen directly. Notice that an ROI can be user defined and can be located using reference points, for example, corners [26].(ii)
TBLK. The MSB-planes of textured blocks at the ROI are chosen. We select8×8 textured blocks from the image using the technique represented in [7]. The MSB-planes of the selected textured blocks are accumulated as a single MSB-plane, where textured blocks are first taken in row-wise and then in column-wise.(iii)
DCTMSB. We can choose the MSBs of DC coefficients of MSB-plane. We divide the MSB-plane into8×8 blocks before taking DCT. Then we take the MSB of DCT coefficients in original space order (without sorting them).(iv)
t-DWT. The MSB-plane of LLt after t-scale wavelet decomposition of the original image is chosen.


## 4.2. Signature Calculation

LetMI={mj}, where 1≤j≤z, be the collective set of MSBs selected from I using one of the above approaches. Without any loss of generality, it is assumed that (1)z≥nwLhL.
The signature SI of I for L with MI is thus calculated as(2)SI(j=(b-1)wLhL+(y-1)hL+x)=mj⊕lb(x,y).
If the generality assumption in (1) cannot be met, mj’s  could be reused iteratively once exhausted. Moreover, any color image can be signed using its gray-scale equivalent with even a colored logo after stripping it into three gray-scale channels. Once the signature is calculated, the owner sends the following message, in the form of a triplet, to the TTP using public key cryptography:(3)MOT=ET,PUB(EO,PRV([I,SI,AI])),
where ET,PUB and EO,PRV are the public and private key encryptions of the TTP and the owner respectively and AI contains information about the MSB selection approach. On receiving the above message from the owner O at time TS, the message is first decrypted to receive the signature triplet as follows: (4)[I,SI,AI]=DO,PUB(DT,PRV(Msg)),
where DO,PUB and DT,PRV are the public and private key decryptions of the owner and the TTP, respectively. The TTP verifies SI for I using AI, appends timestamp TS, and sends back the following message to the owner:(5)MTO=EO,PUB(ET,PRV(SI||TS)),
where EO,PUB and ET,PRV are the public and private key encryptions of the owner and the TTP, respectively. The owner decrypts the above message with his private key as(6)SIc=ET,PRV(SI||TS)=DO,PRV(M2),
where DO,PRV is the private key decryptions of the owner. We name SIc as the certified signature for the image I.


## 4.3. Signature Verification

When a dispute arises for two imagesIi and Ij between two persons P1 and P2, they send the following messages claiming the ownership to the TTP:(7)MP1T=ET,PUB(EP1,PRV(Ii,L1,SIic,AIi)),MP2T=ET,PUB(EP2,PRV(Ij,L2,SIjc,AIj)),
where EP1,PRV and EP2,PRV are the private key encryptions of P1 and P2, respectively. The TTP decrypts the above messages as(8)[Ii,L1,SIic,AIi]=DP1,PUB(DT,PRV(MP1T)),[Ij,L2,SIjc,AIj]=DP2,PUB(DT,PRV(MP2T)),
where DP1,PUB and DP2,PUB are the public key decryptions of P1 and P2, respectively. The TTP then decrypted the certified signatures SIic and SIjc with its public key; this ensures the certificates have been issued by the TTP and the timestamps have not been changed afterwards their generation:(9)SIi‖TSi=DT,PUB(SIic),SIj‖TSj=DT,PUB(SIjc).
The TTP recalculates the signatures SIi and SIj and compares with the existing ones. This check ensures that encrypted signatures SIjc and SIjc have been generated for images Ii and Ij, respectively.


### 4.3.1. Finding Disputable Images

LetL=S-1(I,SI,AI) denote the logo retrieval operation using the inverse process in (2) (see Figure 1(b)). The TTP has to confirm whether images Ii and Ij are disputable before taking a final decision based on the timestamps TSi and TSj. Two images are disputable if they are the same image or one is an attacked version of another. To do that the TTP executes the following two test cases: (10)TC1=S-1(Ii,SIj,AIj)∣S-1(Ij,SIj,AIj),TC2=S-1(Ij,SIi,AIi)∣S-1(Ii,SIi,AIi),
where the logo retrieved from Ii using signature and feature of Ij is compared against the logo of P2, and vice versa. If the logo retrieval rate (LRR), which is the percentage of unchanged bits, and the PSNR (with respect to original logos L1 and L2) of above two test cases TC1 and TC2 are above certain identification thresholds (ThLRR, ThPSNR), then the images are considered as disputable.


### 4.3.2. Verification

IfIi and Ij are proved to be disputable, then the TTP compares timestamps TSi and TSj. The image is authenticated for P1 if TSi<TSj or for P2 if TSi<TSj.


## 4.3.1. Finding Disputable Images

LetL=S-1(I,SI,AI) denote the logo retrieval operation using the inverse process in (2) (see Figure 1(b)). The TTP has to confirm whether images Ii and Ij are disputable before taking a final decision based on the timestamps TSi and TSj. Two images are disputable if they are the same image or one is an attacked version of another. To do that the TTP executes the following two test cases: (10)TC1=S-1(Ii,SIj,AIj)∣S-1(Ij,SIj,AIj),TC2=S-1(Ij,SIi,AIi)∣S-1(Ii,SIi,AIi),
where the logo retrieved from Ii using signature and feature of Ij is compared against the logo of P2, and vice versa. If the logo retrieval rate (LRR), which is the percentage of unchanged bits, and the PSNR (with respect to original logos L1 and L2) of above two test cases TC1 and TC2 are above certain identification thresholds (ThLRR, ThPSNR), then the images are considered as disputable.


## 4.3.2. Verification

IfIi and Ij are proved to be disputable, then the TTP compares timestamps TSi and TSj. The image is authenticated for P1 if TSi<TSj or for P2 if TSi<TSj.


## 4.4. Estimating Identification Thresholds

To avoid the risk of error due to arbitrary selection of identification thresholds (ThLRR, ThPSNR), we propose the following innovative classifier-based threshold estimation technique, which can also be used to test the robustness and uniqueness of any signature-based scheme. The lower the value of (ThLRR, ThPSNR), the lower the scheme is robust.LetTD={[Ii,SIi,AIi]} be a large image training database and let Bi={Ii(j)} be a set of attacked images from Ii for all i. Let(11)TC(a,b,c,d,j)=S-1(Ia(j),SIb,AIc)∣S-1(Id,SId,AId)
be a test case where the logo retrieved from the jth attacked image of Ia using the signature of Ib and the feature of Ic is compared against the logo used to sign Id, 1≤a,b,c,d≤|TD|, and 1≤j≤|Ba|. Let the positive (C+) and negative (C-) classes be defined as(12)C+={∀a,∀j:TC(a,a,a,a,j)},C-={∀a,∀b,∀c,∀d,∀j:TC(a,b,c,d,j)}-C+.
Note that the LRR and PSNR of all the test cases in (C+) should ideally be significantly higher than those in (C-). Any efficient classifier can now be used to separate the positive and negative classes based on the LRR and PSNR of all the test cases and the values of (ThLRR, ThPSNR) can then be estimated synergistically from this classifier.


## 4.5. Robustness and Uniqueness Tests

The identification thresholds (ThLRR, ThPSNR) defined in the previous section is useful for determination of robustness and uniqueness properties of a scheme. A scheme is not robust to a particular attack if the logo retrieved from the corresponding attacked image offers low PSNR and LRR with respect to (ThLRR, ThPSNR). In that case, the corresponding (PSNR, LRR) entry in C+ causes a false negative alarm by the classifier. We need to consider all the tests cases of C+, as defined by (12), in robustness tests. On the other hand, a scheme fails uniqueness test to a particular attack if the signature calculated from image Id verifies the corresponding attacked version of a different image Ia. In that case, the corresponding (PSNR, LRR) entry in C-, as defined by (12), is high with respect to (ThLRR, ThPSNR) and causes a false-positive alarm by the classifier. Therefore, we need to consider only the following test cases of the class C- in uniqueness tests:(13)C-′={∀a,∀d≠a,∀j:TC(a,b,c,d,j)}.


## 5. Performance Study

We implemented the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes with MATLAB 7 and tested their robustness using all the watermarking benchmark images in [23] with different logos against many attacks including those in stirMark 4.0 [24]. However, as we decided almost the same performance for each pair of a benchmark image and a logo, only results obtained using “Lena” and “Elaine” images signed by Monash and NUS logos, respectively (shown in Figure 3), are presented. Where necessary, the attacked images were resized to original. In fact, a corner matching technique can be used to undo the geometric transformations before verifying the copyright information [26].Original images (a) Lena and (b) Elaine with their ROIs used; original logos (c) Monash and (d) NUS; mapped logos by TROI-based scheme [12] (e) Monash (15.19 dB, 53%) and (f) NUS (17.47 dB, 55%); and coded logos by VQ-based scheme [13] (g) Monash (23.40 dB, 64%) and (h) NUS (25.35 dB, 66%). Note that all images (512×512) and logos (64×64) are 8-bit gray-scale. Request granted to use logos for research purposes only.
(a)(b)(c)(d)(e)(f)(g)(h)We used the following two metrics to evaluate the performance: (i) PSNR determines the visual quality of the attacked media or retrieved logo with respect to its original copy; (ii) LRR determines the percentage of bits that are correctly retrieved from the given image using the given signature.In Section5.1, we present different types of attacks we considered in our experiments. Section 5.2 presents the detail classifier setup by different signature-based schemes. Section 5.3 presents the experimental results and discussions. Finally, Section 5.4 provides detail discussions on the overall performance of different signature-based schemes.


### 5.1. Attacks

All the attacks we tested to prove the efficacy of the proposed schemes are in Table2. Below, we represent some attacks that require detail discussions. If not mentioned, the attack was done using MATLAB 7.Table 2
Experimental results (PSNR in dB and LRR in %) by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes against various attacks using Lena image and Monash logo.
AttacksPSNRProposed MSB-based schemeExisting schemesUROITBLKDCTMSBt-DWT1TROI [12]VQ [13]PSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRAffine (XY)520.6619.309614.448814.099410.528814.735414.7958Avg. filter236.8520.589921.419622.049930.2010014.975323.0860BPM (25 dB)22.9414.369112.978511.198915.189613.855623.6773Cropping10.67∞10013.169413.75876.697115.195315.5783Gauss. (G) filter236.8920.589921.439622.049930.2010014.975323.1260G filter2 & noise26.5616.379416.249116.239624.6710014.695523.0761G noise23.0314.599014.548914.499522.099914.525723.4566Histogram equal.19.3613.088614.168912.008618.799816.946217.1055JPEG (quality 0)24.8814.969313.738410.518718.429814.303723.6479JPEG (quality 5)28.2316.899515.069012.819316.759714.864820.6553LSRD320.1612.668811.927210.878614.199513.815521.7670Median filter237.2020.579920.959621.479921.019915.275323.2761Motion filter222.2712.859012.547813.738914.019411.585317.6263Print-copy-scan11.6310.987210.647110.007210.077813.206120.7271Print-scan12.5211.367410.837210.087310.378714.106322.1769MSB (30 dB)30.0010.827510.28778.157613.919415.135323.1462MSB (35 dB)35.0013.368612.578511.658718.689815.165323.3562MSB (40 dB)40.0015.759215.289115.879424.1610015.185323.3964Rot.-crop (2°)19.4816.128910.267311.848611.619113.375319.7464Rot.-scale (2°)19.3316.228910.217311.708511.369013.345319.6564Rot.-scale (5°)11.6611.418210.387010.27705.686211.03526.8660RCR4 (1 in 10)534.0623.829923.429722.399925.4010015.115323.4361Salt and pepper18.5520.569720.439830.6010017.389812.995323.0465Scaling (×0.5)533.9819.079819.639421.139830.8110015.025323.4162Scaling (×2)539.3424.739923.709824.139923.6410015.165323.4966Self similarities26.0416.479515.219011.379025.6110016.715723.4766Small rand. dist.16.2710.988311.457212.92846.757111.555316.3169unZign29.0818.189718.489421.6998∞10014.685423.3865Wiener filter241.3223.819922.119823.279930.6610015.255324.00661Decomposition level t=4.23×3 window.3Latest small rand. dist.4Row-col-removal.5Resized to original.


#### 5.1.1. BPM Attack

Inblind pattern matching (BPM) attack, we divided Lena image into 4×4 nonoverlapping blocks. For each block, the most similar 4×4 block was found out from Elaine image at 25 dB. The block with PSNR greater than or equal to 25 dB was considered as a similar one. Total 15736 blocks were replaced when the attacked image PSNR became 22.94 dB. In the same way, when we attacked Elaine image using Lena image, we replaced total 16371 blocks and attacked image PSNR was 21.99 dB.


#### 5.1.2. Print-Copy-Scan

We printed each image using a 1200 dpi laser printer. The printed image was then photocopied and scanned using a 300 dpi and 8-bit gray-scale scanner. Finally, it was resized to512×512. The PSNR of Lena image after print-copy-scan attack was 11.63 dB and that of Elaine image was 19.56 dB.


#### 5.1.3. MSB Attack

We attacked each image by flipping its MSB-plane. Maximum MSBs were changed at a particular PSNR. First, we found absolute difference of each pixel to flip its MSB. Second, we sorted the absolute differences in the ascending order. Finally, we flipped the MSB of the pixel with lowest absolute difference first. We continued flipping until the PSNR is decreased beyond a particular value. Since this attack changes the maximum number of MSBs for a given target PSNR, the proposed MSB-based scheme should suffer the most. However, we observed that most images cannot be degraded to less than 20 dB even if all of its MSBs were flipped. After the MSB attack at 30 dB the MSB similarity rate for Lena image was 73% and for Elaine image was 70%.


#### 5.1.4. unZign Attack

The image was divided into8×8 blocks. A pixel was selected randomly from each block and was either deleted or repeated randomly. All blocks were then put back in their original positions. The PSNR of Lena image after unZign attack was 29.08 dB and that of Elaine image was 29.79 dB.


#### 5.1.5. Self-Similarities

This attack was done by stirMark 4.0 in RGB space of the image. The image was then converted to its gray-scale equivalent. The PSNR of Lena image after this attack was 26.04 dB and that of Elaine image was 25.48 dB.


### 5.2. Classifiers

In order to design classifiers for the different approaches, that is, UROI, TBLK, DCTMSB, andt-DWT, of the proposed MSB-based and existing TROI-based [12] and VQ-based [13] schemes, we used 10 different types of attacked images as shown in Table 3. We assigned numbers to the attacks for later references. The image Lena was signed using Monash logo and the image Elaine was signed with NUS logo. Then, different attacked images of Lena and Elaine were sent after signing with different logos with different or same AI for verification. For UROI approach and TROI-based scheme, AI indicates the same or different ROIs; while for t-DWT approach and VQ-based scheme, AI indicates the same or different decomposition levels; and for TBLK approach, AI indicates same or different set of textured blocks. We had total 8 different types of data points with two pairs of images and logos (Lena-Monash and Elaine-NUS). Therefore, maximum 160 logo retrieval instances (20 in C+ and 140 in C-) were used while designing each classifier. However, in the case of DCTMSB approach, there were total 80 instances (20 in C+ and 60 in C-); since for the same type and size (8-bit, 64×64) of logo, the image was divided into blocks of the same size (4×2) before taking DCT, assuming the image size (512×512) also remained the same. On the other hand, for VQ-based scheme, there were total 120 instances (20 in C+ and 100 in C-); since with different decomposition levels t, logo retrieval operation was not possible from a smaller codebook (due to larger t) using the indices set containing higher indices values, while it was possible from a bigger codebook (due to smaller t) using the indices set containing lower indices values.Table 3
Attacks considered while designing the classifier.
AttacksPSNR (dB)NumberNameLenaElaine0Affine120.6618.691Blurring236.8942.742Cropping310.679.643Histogram equal.19.3618.234JPEG (quality 5)28.2328.025Rot.-crop 2°19.4817.686Rot.-scale 2°19.3317.587Rot.-scale 5°11.6611.538Small rand. dist.16.2718.559MSB attack35.0035.001Resized to original after XY-shearing.2Gaussian filter.3Cropping excluding ROI.We usedsupport vector machines (SVMs) with linear kernel [27] and K-means clustering [28] separately for classification. Results by both SVM classification and K-means clustering are useful for the determination of the robustness and the uniqueness properties of the proposed and existing schemes. SVM results, especially, enabled to find out the values for identification thresholds (ThLRR,ThPSNR), defined in Section 4.3. The more the accuracy of the classification and the distance d between the support vectors of the SVM for a scheme, the more the scheme is robust (i.e., the two classes are well separated).In the robustness test, the distance from a data point inC+ (corresponding to an attack) to the SVM decision hyperplane is used to decide different levels of robustness (high, medium, low, and no). For example, if the data point is correctly classified and resides outside the nearest support vector (i.e., far away from the decision plane), then the robustness against the corresponding attack is high. If the data point is correctly classified but stays in the space between the nearest support vector and the decision plane and then the robustness against the corresponding attack is medium (when close to the support vector) or low (when close to the decision plane). If the data point is on the other side of the hyper plane (misclassified), then the copyright scheme is not robust to the corresponding attack. In the uniqueness test, if a data point in C-′ (corresponding to an attack) is incorrectly classified then the scheme does not possess the uniqueness property under this attack.


### 5.3. Experimental Results

We will present the experimental results in two parts. In Section5.3.1, we present the robustness of the proposed and existing schemes in terms of PSNR and LRR under different attacks. In Section 5.3.2, we present the classifiers from which we can evaluate overall robustness and uniqueness of the respective signature-based schemes.


#### 5.3.1. Robustness Results

In this section, we first present and discuss robustness results of the proposed and existing schemes under different attacks. We then detail the results for two attacks—JPEG which is the most common unintentional attack and newly proposed MSB attack which would defeat our scheme the most.Table2 shows the logo retrieval results using Lena image and Monash logo by different approaches of the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 4 shows the attacked images along with their corresponding retrieved logos using Lena image and Monash logo. Table 5 and Table 6 present the same, respectively, using Elaine image and NUS logo.Table 4
Attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓20.6622.9436.8910.6719.3628.2311.6319.4829.08UROI19.30, 9614.36, 9120.58, 99∞,10013.08, 8616.89, 9510.98, 7216.12, 8918.18, 97TBLK14.44, 8812.97, 8521.43, 9613.16, 9414.16, 8915.06, 9010.64, 7110.26, 7318.48, 94DCTMSB14.09, 9411.19, 8922.04, 9913.75, 8712.00, 8612.81, 9310.00, 7211.84, 8621.69, 98t-DWT (t=4)10.52, 8815.18, 9630.20, 1006.69, 7118.79, 9816.75, 9710.07, 7811.61, 91∞, 100TROI [12]14.73, 5413.85, 5614.97, 5315.19, 5316.94, 6214.86, 4813.20, 6113.37, 5314.68, 54VQ [13]14.79, 5823.67, 7323.12, 6015.57, 8317.10, 5520.65, 5320.72, 7119.74, 6423.38, 651Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).Table 5
Experimental results (PSNR in dB and LRR in %) by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes against various attacks using Elaine image and NUS logo.
AttacksPSNRProposed MSB-based schemeExisting schemesUROITBLKDCTMSBt-DWT1TROI [12]VQ [13]PSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRAffine (XY)518.6913.869017.338814.488617.849216.405621.1261Avg. filter234.0919.179822.909724.439827.019917.515625.3269BPM (25 dB)21.9912.798815.618414.578617.259316.625523.2955Cropping9.64∞10041.959916.558112.177017.47557.7848Gauss. (G) filter242.7423.589926.519927.329933.0910017.505525.3568G filter2 & noise20.0512.848815.838517.159225.469915.595525.2668G noise20.0912.578815.808516.929225.689915.655525.1970Histogram equal.18.2316.979619.829518.379421.209714.725622.7665JPEG (quality 0)25.1413.698917.748614.638620.269616.855821.1370JPEG (quality 5)28.0216.209419.539117.009122.279717.145625.0265LSRD314.9410.997512.287612.237511.847112.305315.5758Median filter224.3713.959118.078814.978727.349916.535625.2767Motion filter225.5414.619319.008418.549419.419517.145524.3565Print-copy-scan19.5613.499016.048815.649215.759015.995620.2750Print-scan22.3215.489419.719320.439521.399616.325724.6268MSB (30 dB)30.008.526611.596512.817420.019617.105024.8368MSB (35 dB)35.009.857813.967915.048524.269917.395125.2568MSB (40 dB)40.0011.518615.778717.819230.2310017.465325.3366Rot.-crop (2°)17.6813.848416.268514.368114.898615.135620.0865Rot.-scale (2°)17.5813.798416.068514.268114.858615.105619.9266Rot.-scale (5°)11.5311.737611.297611.106811.246513.295413.0562RCR4 (1 in 10)525.2014.489218.578915.728929.289916.685625.3469Salt & pepper22.6025.619925.239934.7210022.989916.245425.0472Scaling (×0.5)525.0914.399218.298915.9790∞10016.725725.3667Scaling (×2)525.6614.249218.638915.508928.5810016.765725.3168Self similarities25.4814.639218.448915.338829.5210016.825625.3668Small rand. dist.18.5511.998516.128413.628417.249115.105420.4067unZign29.7919.029723.809724.039833.0910017.265525.3568Wiener filter236.5220.109820.969725.129927.909915.205224.45671Decomposition level t=4.23×3 window.3Latest small random distortion.4Row-col-removal.5Resized to original.Table 6
Attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓18.6921.9942.749.6418.2328.0219.5617.6829.79UROI13.86, 9012.79, 8823.58, 99∞, 10016.97, 9616.20, 9413.49, 9013.84, 8419.02, 97TBLK17.33, 8815.61, 8426.51, 9941.95, 9919.82, 9519.53, 9116.04, 8816.26, 8523.80, 97DCTMSB14.48, 8614.57, 8627.32, 9916.55, 8118.37, 9417.00, 9115.64, 9214.36, 8124.03, 98t-DWT (t=4)17.84, 9217.25, 9333.09, 10012.17, 7021.20, 9722.27, 9715.75, 9014.89, 8633.09, 100TROI [12]16.40, 5616.62, 5517.50, 5517.47, 5514.72, 5617.14, 5615.99, 5615.13, 5617.26, 55VQ [13]21.12, 6123.29, 5525.35, 687.78, 4822.76, 6525.02, 6520.27, 5020.08, 6525.35, 681Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).We observed that all the approaches of the proposed scheme performed almost the same except thet-DWT approach which was sensitive to geometric distortions. In contrast, both the TROI-based and VQ-based schemes were very much sensitive to geometric attacks and the former did not survive under high JPEG lossy compression (quality less than 10). In most of the cases, the PSNR and in all the cases the LRR of the retrieved logos by the proposed scheme were higher than those by the TROI-based scheme. In the remaining few cases, the PSNR of the retrieved logos by the proposed scheme were lower. In most of the cases, the LRR by the MSB-based scheme was higher than the VQ-based scheme; while in many cases, the PSNR by the latter was higher due to its VQ coding. However, it is no way an indication to the superiority of the existing schemes for these kinds of attacks; because the logo quality degrades severely during the torus-mapping and VQ coding, as shown in Figures 3(e)–3(h), and as a consequence the PSNR and LRR remained almost unchanged irrespective of logos.Table7 presents the MSB-attacked images along with their corresponding retrieved logos using Lena image and Monash logo by the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 8 presents the same using Elaine image and NUS logo. Among the approaches of the proposed scheme, DWT-based approach showed the highest resistance against the MSB attack. The proposed scheme survived down to PSNR 30 dB of the attacked image. Lee and Chen [13] argued that the visual quality of the image is unacceptable to the human eyes if the PSNR is less than 30 dB. Moreover, we observed that the proposed scheme performed better if the PSNR of the MSB attacked image increases, while for the existing schemes the PSNR and LRR of the retrieved logos remained almost unchanged irrespective of the PSNR of the attacked images. However, since the distortion in an image is more noticeable in the mid-gray region and sensitivity changes parabolically as the gray value fluctuates on the both sides of mid-gray level [7], as a precaution to the MSB attack, we suggest excluding mid-gray pixels during signature calculation.Table 7
MSB attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked1 Images2→Schemes3↓20.00, 2825.00, 5430.00, 7335.00, 8540.00, 9245.00, 9750.00, 99UROI3.99, 178.00, 5810.82, 7513.36, 8615.75, 9218.98, 9622.46, 99TBLK3.84, 307.59, 6310.28, 7712.57, 8515.28, 9118.33, 9521.93, 98DCTMSB3.31, 315.57, 578.15, 7611.65, 8715.87, 9419.46, 9823.53, 99t-DWT (t=4)7.15, 739.87, 8613.91, 9418.68, 9824.16, 100∞, 100∞, 100TROI [12]12.36, 5114.92, 5215.13, 5315.16, 5315.18, 5315.19, 5315.19, 53VQ [13]20.25, 6322.34, 6223.14, 6223.35, 6223.39, 6423.40, 6523.40, 641Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Table 8
MSB attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked Images1,2→Schemes3↓20.00, 3125.00, 5430.00, 7035.00, 8140.00, 8845.00, 9250.00, 95UROI6.41, 267.04, 468.52, 669.85, 7811.51, 8613.21, 9114.93, 94TBLK7.59, 239.45, 4411.59, 6513.96, 7915.77, 8717.79, 9119.49, 94DCTMSB8.04, 3310.41, 5612.81, 7415.04, 8517.81, 9220.00, 9521.51, 97t-DWT(t=4)13.21, 7916.31, 9020.01, 9624.26, 9930.23, 10037.98, 100∞, 100DCT15.86, 9120.43, 9726.21, 9934.59, 10044.10, 10069.20, 100∞, 100TROI [12]16.25, 4516.72, 4917.10, 5017.39, 5117.46, 5317.47, 5317.47, 54VQ [13]19.20, 4923.28, 6124.83, 6825.25, 6825.33, 6625.34, 6625.34, 681Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Figure4(a) plots the LRR and Figure 4(b) plots the PSNR of the retrieved logos using Lena image and Monash logo against different JPEG quality factors. Figure 5(a) and Figure 5(b) plot the same using Elaine image and NUS logo. We found that the t-DWT approach performed the best among different approaches of the MSB-based scheme and existing TROI-based and VQ-based schemes. Both the LRR and PSNR increased with the increase of JPEG quality factor for the proposed scheme, while for the existing schemes they remained almost the same. While the proposed scheme always offered higher LRR; it outperformed the existing schemes in term of the PSNR when JPEG quality factor was greater than 70. This result is consistent with the observation made in motivation.(a) Logo retrieval rate and (b) PSNR using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)(a) Logo retrieval rate and (b) PSNR using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)


#### 5.3.2. Classification Results (Robustness and Uniqueness)

In this section, we present and discuss classification results of the proposed and existing schemes. We can infer the overall robustness and uniqueness of each scheme from the respective classifier.Figures6, 7, 8, 9, 10, and 11 present classification results using SVM with linear kernel [27] and K-means clustering [28] separating the positive and negative classes of test cases, defined in the Section 4.3, for the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Though we conducted the experiments with all entries in C-, for clarity we show C-′, as defined in (13), instead of C- in Figure 6 to Figure 11. Table 9 shows the classification results obtained by SVM and K-means. If for a scheme a data point in C+corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be robust under that attack. Similarly, if for a scheme a data point in C-′ corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be unique under that attack. While the classes could be distinctively separated (no misclassification) with a large distance d between the support vectors for UROI (d=30.2), TBLK (d=31.4), and DCTMSB (d=31.4) approaches of the proposed scheme; the SVM classifier for t-DWT approach resulted in 5% positive misclassification with a large d=25.0 and the classifiers for the TROI-based (d=10.0) and VQ-based (d=9.2) schemes resulted in 20% and 30% positive misclassifications, respectively. We found no miss by K-means clustering for UROI, TBLK, and DCTMSB approaches, while for t-DWT approach and TROI- and VQ-based schemes, we found 35% positive, 26% negative, and 30% positive miss, respectively. Logo quality degradation due to torus-mapping and VQ coding constitute this problem for the existing schemes. Note that no misclassification and the large separation between positive and negative classes for UROI, TBLK, and DCTMSB approaches of the MSB-based scheme is so significant that simple PSNR-only (vertical) or LRR-only (horizontal) linear classifier can be used as well. Considering classification and clustering results and the distance from the SVM decision hyperplane to a corresponding entry of a particular attack, we took the decision of robustness and uniqueness tests. From Table 9, we see that UROI and DCTMSB approaches are highly robust and TBLK approach is moderately robust; while TROI-based scheme failed both robustness and uniqueness tests, and t-DWT approach and VQ-based scheme failed robustness test. We found that TBLK and t-DWT approaches are highly sensitive to geometric attacks.Table 9
Results and decisions for different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes by the support vector machines (SVM) [27] and K-means clustering algorithm [28].
SchemesNumber of miss (%)To individual attacks (robustness:h = high, m = moderate,Size of training setby SVMbyK-meansDistance1l = low, and n = no robustness; and f = uniqueness fail)2,3C+C−C+C−C+C−d0123456789Over4UROI201400 (0)0 (0)0 (0)0 (0)30.2hhhhhhhmmhhTBLK201400 (0)0 (0)0 (0)0 (0)31.5mhhhhllllmmDCTMSB20600 (0)0 (0)0 (0)0 (0)31.3mhhhhmmlmhht-DWT201401 (5)0 (0)7 (35)0 (0)25.1nhnmhnnnnhnTROI [12]201406 (30)0 (0)0 (0)36 (26)5.1n, fl, fn, fm, fl, fn, fn, fn, fn, fm, fn, fVQ [13]2010011 (55)0 (0)6 (30)0 (0)9.2nmnlhnnnnmn1Distance between support vectors.2Robustness: correctly classified by both SVM and K-means with h = high PSNR and LRR, m = moderate PSNR and LRR, and l = low PSNR and LRR; no robustness: n = any false negative by SVM or K-means; and uniqueness fail: f = any false positive by SVM or K-means.3Attack numbers 0-9 are referred using Table 3; and4Overall decision.Figure 6
SVM classification andK-means clustering results by the UROI approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=30.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 7
SVM classification andK-means clustering results by the TBLK approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.5 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 8
SVM classification andK-means clustering results by the DCTMSB approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.3 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 9
SVM classification andK-means clustering results by the t-DWT (t = 4) approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=25.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 10
SVM classification andK-means clustering results by the existing TROI-based scheme [12]. Note that the distance between support vectors by SVM [27] is d=5.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 11
SVM classification andK-means clustering results by the existing VQ-based scheme [13]. Note that the distance between support vectors by SVM [27] is D=9.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.


### 5.4. Comparisons and Discussions

Table10 presents comparisons among the different approaches of the proposed MSB-based scheme and the existing TROI-based [12] and VQ-based [13] schemes. The MSB-based scheme possesses transparency because it does not embed any information to the published image. UROI, TBLK, and DCTMSB approaches are robust, while t-DWT approach failed. In contrast, due to very low PSNR and LRR both TROI-based and VQ-based schemes are not robust and TROI-based scheme failed uniqueness test. The security of the MSB-based scheme is the same as the security of the digital signature and the digital timestamp. The classification and clustering results showed that UROI, TBLK, and DCTMSB approaches are unambiguous due to correctly classification by SVM with a large d between the support vectors and no miss by K-means, while t-DWT approach is ambiguous due to positive misclassification by both SVM and TROI. In contrast, the existing schemes are ambiguous because of high positive misclassifications. In our experiments, we also used the polynomial kernel for TROI-based and VQ-based schemes and found high misclassifications. The MSB-based scheme is not blind as the TTP finds whether images are disputable by comparing signatures calculated from them before taking the decision based on the timestamps. The TROI-based scheme is also not blind too; because as the published image does not contain any information, the original image must be used to find out the corresponding signature from the owner’s database. On the other hand, the VQ-based scheme is blind as it adds the signature with the image header before publishing. However, this signature addition not only increases the file size but also creates severe problem of losing copyright if an attacker removes the signature from the image header. The MSB-based scheme can handle multiple logos (multiple watermarking) like the existing schemes. An image may be signed using the same or different types of logos by the same owner.Table 10
Comparisons of different approaches of the proposed scheme and existing schemes [12, 13].
IssuesExistingApproaches of the proposed MSB-based schemeTROI [12]VQ [13]UROITBLKDCTMSBt-DWTTransparencyyesyesyesyesyesyesRobustnessnonohighmoderatehighnoUniquenessnoyesyesyesyesyesUnambiguousnonoyesyesyesnoSecurityyesyesyesyesyesyesBlindnesssemi-blindblindsemi-blindsemi-blindsemi-blindsemi-blindMultiple logoyesyesyesyesyesyesPublicly verifiablenoyesnonononoStirMark resistancenonomoderatelowmoderatenoMSB attack resistancemoderatehighmoderatemoderatemoderatehighScalability1nonoyesyesyesyesSignature addition2noyesnonononoJPEG quality < 10lowhighhighhighhighhighOperation domainspatialDWTspatialspatialDCTDWTTime complexityhighhighconstantlowlowlowAlgorithm simplicitynonoyesyesyesyesRegion-of-interest usedyesnoyesnonono1Signature calculation using different types of image and logo.2With image header.The scheme by Lee and Chen [13] is publicly verifiable as it adds the signature with the image header. On the other hand, the ownership dispute is handled through the TTP by the MSB-based scheme. In TROI-based scheme, the owner keeps the security parameters secret himself. The existing schemes and t-DWT approach is not much robust as they offer low PSNR and LRR against stirMark attacks. However, t-DWT approach and VQ-based schemes showed high robustness to MSB attack, while UROI, TBLK, and DCTMSB approaches and TROI-based scheme showed moderate robustness. Any type and size of logos can be signed with an 8-bit gray-scale image by the MSB-based scheme, while the TROI-based and VQ-based schemes can sign only 8-bit gray-scale logos. The existing schemes are highly time consuming due to use of torus mapping and VQ encoding. In contrast, the MSB-based scheme is simple due to use of the MSB-plane; especially, the UROI approach is the simplest as it does not involve any transform domain operation. The proposed scheme also presents a comprehensive TTP management policy in order to secure the e-commerce.


## 5.1. Attacks

All the attacks we tested to prove the efficacy of the proposed schemes are in Table2. Below, we represent some attacks that require detail discussions. If not mentioned, the attack was done using MATLAB 7.Table 2
Experimental results (PSNR in dB and LRR in %) by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes against various attacks using Lena image and Monash logo.
AttacksPSNRProposed MSB-based schemeExisting schemesUROITBLKDCTMSBt-DWT1TROI [12]VQ [13]PSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRAffine (XY)520.6619.309614.448814.099410.528814.735414.7958Avg. filter236.8520.589921.419622.049930.2010014.975323.0860BPM (25 dB)22.9414.369112.978511.198915.189613.855623.6773Cropping10.67∞10013.169413.75876.697115.195315.5783Gauss. (G) filter236.8920.589921.439622.049930.2010014.975323.1260G filter2 & noise26.5616.379416.249116.239624.6710014.695523.0761G noise23.0314.599014.548914.499522.099914.525723.4566Histogram equal.19.3613.088614.168912.008618.799816.946217.1055JPEG (quality 0)24.8814.969313.738410.518718.429814.303723.6479JPEG (quality 5)28.2316.899515.069012.819316.759714.864820.6553LSRD320.1612.668811.927210.878614.199513.815521.7670Median filter237.2020.579920.959621.479921.019915.275323.2761Motion filter222.2712.859012.547813.738914.019411.585317.6263Print-copy-scan11.6310.987210.647110.007210.077813.206120.7271Print-scan12.5211.367410.837210.087310.378714.106322.1769MSB (30 dB)30.0010.827510.28778.157613.919415.135323.1462MSB (35 dB)35.0013.368612.578511.658718.689815.165323.3562MSB (40 dB)40.0015.759215.289115.879424.1610015.185323.3964Rot.-crop (2°)19.4816.128910.267311.848611.619113.375319.7464Rot.-scale (2°)19.3316.228910.217311.708511.369013.345319.6564Rot.-scale (5°)11.6611.418210.387010.27705.686211.03526.8660RCR4 (1 in 10)534.0623.829923.429722.399925.4010015.115323.4361Salt and pepper18.5520.569720.439830.6010017.389812.995323.0465Scaling (×0.5)533.9819.079819.639421.139830.8110015.025323.4162Scaling (×2)539.3424.739923.709824.139923.6410015.165323.4966Self similarities26.0416.479515.219011.379025.6110016.715723.4766Small rand. dist.16.2710.988311.457212.92846.757111.555316.3169unZign29.0818.189718.489421.6998∞10014.685423.3865Wiener filter241.3223.819922.119823.279930.6610015.255324.00661Decomposition level t=4.23×3 window.3Latest small rand. dist.4Row-col-removal.5Resized to original.


### 5.1.1. BPM Attack

Inblind pattern matching (BPM) attack, we divided Lena image into 4×4 nonoverlapping blocks. For each block, the most similar 4×4 block was found out from Elaine image at 25 dB. The block with PSNR greater than or equal to 25 dB was considered as a similar one. Total 15736 blocks were replaced when the attacked image PSNR became 22.94 dB. In the same way, when we attacked Elaine image using Lena image, we replaced total 16371 blocks and attacked image PSNR was 21.99 dB.


### 5.1.2. Print-Copy-Scan

We printed each image using a 1200 dpi laser printer. The printed image was then photocopied and scanned using a 300 dpi and 8-bit gray-scale scanner. Finally, it was resized to512×512. The PSNR of Lena image after print-copy-scan attack was 11.63 dB and that of Elaine image was 19.56 dB.


### 5.1.3. MSB Attack

We attacked each image by flipping its MSB-plane. Maximum MSBs were changed at a particular PSNR. First, we found absolute difference of each pixel to flip its MSB. Second, we sorted the absolute differences in the ascending order. Finally, we flipped the MSB of the pixel with lowest absolute difference first. We continued flipping until the PSNR is decreased beyond a particular value. Since this attack changes the maximum number of MSBs for a given target PSNR, the proposed MSB-based scheme should suffer the most. However, we observed that most images cannot be degraded to less than 20 dB even if all of its MSBs were flipped. After the MSB attack at 30 dB the MSB similarity rate for Lena image was 73% and for Elaine image was 70%.


### 5.1.4. unZign Attack

The image was divided into8×8 blocks. A pixel was selected randomly from each block and was either deleted or repeated randomly. All blocks were then put back in their original positions. The PSNR of Lena image after unZign attack was 29.08 dB and that of Elaine image was 29.79 dB.


### 5.1.5. Self-Similarities

This attack was done by stirMark 4.0 in RGB space of the image. The image was then converted to its gray-scale equivalent. The PSNR of Lena image after this attack was 26.04 dB and that of Elaine image was 25.48 dB.


## 5.1.1. BPM Attack

Inblind pattern matching (BPM) attack, we divided Lena image into 4×4 nonoverlapping blocks. For each block, the most similar 4×4 block was found out from Elaine image at 25 dB. The block with PSNR greater than or equal to 25 dB was considered as a similar one. Total 15736 blocks were replaced when the attacked image PSNR became 22.94 dB. In the same way, when we attacked Elaine image using Lena image, we replaced total 16371 blocks and attacked image PSNR was 21.99 dB.


## 5.1.2. Print-Copy-Scan

We printed each image using a 1200 dpi laser printer. The printed image was then photocopied and scanned using a 300 dpi and 8-bit gray-scale scanner. Finally, it was resized to512×512. The PSNR of Lena image after print-copy-scan attack was 11.63 dB and that of Elaine image was 19.56 dB.


## 5.1.3. MSB Attack

We attacked each image by flipping its MSB-plane. Maximum MSBs were changed at a particular PSNR. First, we found absolute difference of each pixel to flip its MSB. Second, we sorted the absolute differences in the ascending order. Finally, we flipped the MSB of the pixel with lowest absolute difference first. We continued flipping until the PSNR is decreased beyond a particular value. Since this attack changes the maximum number of MSBs for a given target PSNR, the proposed MSB-based scheme should suffer the most. However, we observed that most images cannot be degraded to less than 20 dB even if all of its MSBs were flipped. After the MSB attack at 30 dB the MSB similarity rate for Lena image was 73% and for Elaine image was 70%.


## 5.1.4. unZign Attack

The image was divided into8×8 blocks. A pixel was selected randomly from each block and was either deleted or repeated randomly. All blocks were then put back in their original positions. The PSNR of Lena image after unZign attack was 29.08 dB and that of Elaine image was 29.79 dB.


## 5.1.5. Self-Similarities

This attack was done by stirMark 4.0 in RGB space of the image. The image was then converted to its gray-scale equivalent. The PSNR of Lena image after this attack was 26.04 dB and that of Elaine image was 25.48 dB.


## 5.2. Classifiers

In order to design classifiers for the different approaches, that is, UROI, TBLK, DCTMSB, andt-DWT, of the proposed MSB-based and existing TROI-based [12] and VQ-based [13] schemes, we used 10 different types of attacked images as shown in Table 3. We assigned numbers to the attacks for later references. The image Lena was signed using Monash logo and the image Elaine was signed with NUS logo. Then, different attacked images of Lena and Elaine were sent after signing with different logos with different or same AI for verification. For UROI approach and TROI-based scheme, AI indicates the same or different ROIs; while for t-DWT approach and VQ-based scheme, AI indicates the same or different decomposition levels; and for TBLK approach, AI indicates same or different set of textured blocks. We had total 8 different types of data points with two pairs of images and logos (Lena-Monash and Elaine-NUS). Therefore, maximum 160 logo retrieval instances (20 in C+ and 140 in C-) were used while designing each classifier. However, in the case of DCTMSB approach, there were total 80 instances (20 in C+ and 60 in C-); since for the same type and size (8-bit, 64×64) of logo, the image was divided into blocks of the same size (4×2) before taking DCT, assuming the image size (512×512) also remained the same. On the other hand, for VQ-based scheme, there were total 120 instances (20 in C+ and 100 in C-); since with different decomposition levels t, logo retrieval operation was not possible from a smaller codebook (due to larger t) using the indices set containing higher indices values, while it was possible from a bigger codebook (due to smaller t) using the indices set containing lower indices values.Table 3
Attacks considered while designing the classifier.
AttacksPSNR (dB)NumberNameLenaElaine0Affine120.6618.691Blurring236.8942.742Cropping310.679.643Histogram equal.19.3618.234JPEG (quality 5)28.2328.025Rot.-crop 2°19.4817.686Rot.-scale 2°19.3317.587Rot.-scale 5°11.6611.538Small rand. dist.16.2718.559MSB attack35.0035.001Resized to original after XY-shearing.2Gaussian filter.3Cropping excluding ROI.We usedsupport vector machines (SVMs) with linear kernel [27] and K-means clustering [28] separately for classification. Results by both SVM classification and K-means clustering are useful for the determination of the robustness and the uniqueness properties of the proposed and existing schemes. SVM results, especially, enabled to find out the values for identification thresholds (ThLRR,ThPSNR), defined in Section 4.3. The more the accuracy of the classification and the distance d between the support vectors of the SVM for a scheme, the more the scheme is robust (i.e., the two classes are well separated).In the robustness test, the distance from a data point inC+ (corresponding to an attack) to the SVM decision hyperplane is used to decide different levels of robustness (high, medium, low, and no). For example, if the data point is correctly classified and resides outside the nearest support vector (i.e., far away from the decision plane), then the robustness against the corresponding attack is high. If the data point is correctly classified but stays in the space between the nearest support vector and the decision plane and then the robustness against the corresponding attack is medium (when close to the support vector) or low (when close to the decision plane). If the data point is on the other side of the hyper plane (misclassified), then the copyright scheme is not robust to the corresponding attack. In the uniqueness test, if a data point in C-′ (corresponding to an attack) is incorrectly classified then the scheme does not possess the uniqueness property under this attack.


## 5.3. Experimental Results

We will present the experimental results in two parts. In Section5.3.1, we present the robustness of the proposed and existing schemes in terms of PSNR and LRR under different attacks. In Section 5.3.2, we present the classifiers from which we can evaluate overall robustness and uniqueness of the respective signature-based schemes.


### 5.3.1. Robustness Results

In this section, we first present and discuss robustness results of the proposed and existing schemes under different attacks. We then detail the results for two attacks—JPEG which is the most common unintentional attack and newly proposed MSB attack which would defeat our scheme the most.Table2 shows the logo retrieval results using Lena image and Monash logo by different approaches of the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 4 shows the attacked images along with their corresponding retrieved logos using Lena image and Monash logo. Table 5 and Table 6 present the same, respectively, using Elaine image and NUS logo.Table 4
Attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓20.6622.9436.8910.6719.3628.2311.6319.4829.08UROI19.30, 9614.36, 9120.58, 99∞,10013.08, 8616.89, 9510.98, 7216.12, 8918.18, 97TBLK14.44, 8812.97, 8521.43, 9613.16, 9414.16, 8915.06, 9010.64, 7110.26, 7318.48, 94DCTMSB14.09, 9411.19, 8922.04, 9913.75, 8712.00, 8612.81, 9310.00, 7211.84, 8621.69, 98t-DWT (t=4)10.52, 8815.18, 9630.20, 1006.69, 7118.79, 9816.75, 9710.07, 7811.61, 91∞, 100TROI [12]14.73, 5413.85, 5614.97, 5315.19, 5316.94, 6214.86, 4813.20, 6113.37, 5314.68, 54VQ [13]14.79, 5823.67, 7323.12, 6015.57, 8317.10, 5520.65, 5320.72, 7119.74, 6423.38, 651Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).Table 5
Experimental results (PSNR in dB and LRR in %) by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes against various attacks using Elaine image and NUS logo.
AttacksPSNRProposed MSB-based schemeExisting schemesUROITBLKDCTMSBt-DWT1TROI [12]VQ [13]PSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRAffine (XY)518.6913.869017.338814.488617.849216.405621.1261Avg. filter234.0919.179822.909724.439827.019917.515625.3269BPM (25 dB)21.9912.798815.618414.578617.259316.625523.2955Cropping9.64∞10041.959916.558112.177017.47557.7848Gauss. (G) filter242.7423.589926.519927.329933.0910017.505525.3568G filter2 & noise20.0512.848815.838517.159225.469915.595525.2668G noise20.0912.578815.808516.929225.689915.655525.1970Histogram equal.18.2316.979619.829518.379421.209714.725622.7665JPEG (quality 0)25.1413.698917.748614.638620.269616.855821.1370JPEG (quality 5)28.0216.209419.539117.009122.279717.145625.0265LSRD314.9410.997512.287612.237511.847112.305315.5758Median filter224.3713.959118.078814.978727.349916.535625.2767Motion filter225.5414.619319.008418.549419.419517.145524.3565Print-copy-scan19.5613.499016.048815.649215.759015.995620.2750Print-scan22.3215.489419.719320.439521.399616.325724.6268MSB (30 dB)30.008.526611.596512.817420.019617.105024.8368MSB (35 dB)35.009.857813.967915.048524.269917.395125.2568MSB (40 dB)40.0011.518615.778717.819230.2310017.465325.3366Rot.-crop (2°)17.6813.848416.268514.368114.898615.135620.0865Rot.-scale (2°)17.5813.798416.068514.268114.858615.105619.9266Rot.-scale (5°)11.5311.737611.297611.106811.246513.295413.0562RCR4 (1 in 10)525.2014.489218.578915.728929.289916.685625.3469Salt & pepper22.6025.619925.239934.7210022.989916.245425.0472Scaling (×0.5)525.0914.399218.298915.9790∞10016.725725.3667Scaling (×2)525.6614.249218.638915.508928.5810016.765725.3168Self similarities25.4814.639218.448915.338829.5210016.825625.3668Small rand. dist.18.5511.998516.128413.628417.249115.105420.4067unZign29.7919.029723.809724.039833.0910017.265525.3568Wiener filter236.5220.109820.969725.129927.909915.205224.45671Decomposition level t=4.23×3 window.3Latest small random distortion.4Row-col-removal.5Resized to original.Table 6
Attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓18.6921.9942.749.6418.2328.0219.5617.6829.79UROI13.86, 9012.79, 8823.58, 99∞, 10016.97, 9616.20, 9413.49, 9013.84, 8419.02, 97TBLK17.33, 8815.61, 8426.51, 9941.95, 9919.82, 9519.53, 9116.04, 8816.26, 8523.80, 97DCTMSB14.48, 8614.57, 8627.32, 9916.55, 8118.37, 9417.00, 9115.64, 9214.36, 8124.03, 98t-DWT (t=4)17.84, 9217.25, 9333.09, 10012.17, 7021.20, 9722.27, 9715.75, 9014.89, 8633.09, 100TROI [12]16.40, 5616.62, 5517.50, 5517.47, 5514.72, 5617.14, 5615.99, 5615.13, 5617.26, 55VQ [13]21.12, 6123.29, 5525.35, 687.78, 4822.76, 6525.02, 6520.27, 5020.08, 6525.35, 681Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).We observed that all the approaches of the proposed scheme performed almost the same except thet-DWT approach which was sensitive to geometric distortions. In contrast, both the TROI-based and VQ-based schemes were very much sensitive to geometric attacks and the former did not survive under high JPEG lossy compression (quality less than 10). In most of the cases, the PSNR and in all the cases the LRR of the retrieved logos by the proposed scheme were higher than those by the TROI-based scheme. In the remaining few cases, the PSNR of the retrieved logos by the proposed scheme were lower. In most of the cases, the LRR by the MSB-based scheme was higher than the VQ-based scheme; while in many cases, the PSNR by the latter was higher due to its VQ coding. However, it is no way an indication to the superiority of the existing schemes for these kinds of attacks; because the logo quality degrades severely during the torus-mapping and VQ coding, as shown in Figures 3(e)–3(h), and as a consequence the PSNR and LRR remained almost unchanged irrespective of logos.Table7 presents the MSB-attacked images along with their corresponding retrieved logos using Lena image and Monash logo by the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 8 presents the same using Elaine image and NUS logo. Among the approaches of the proposed scheme, DWT-based approach showed the highest resistance against the MSB attack. The proposed scheme survived down to PSNR 30 dB of the attacked image. Lee and Chen [13] argued that the visual quality of the image is unacceptable to the human eyes if the PSNR is less than 30 dB. Moreover, we observed that the proposed scheme performed better if the PSNR of the MSB attacked image increases, while for the existing schemes the PSNR and LRR of the retrieved logos remained almost unchanged irrespective of the PSNR of the attacked images. However, since the distortion in an image is more noticeable in the mid-gray region and sensitivity changes parabolically as the gray value fluctuates on the both sides of mid-gray level [7], as a precaution to the MSB attack, we suggest excluding mid-gray pixels during signature calculation.Table 7
MSB attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked1 Images2→Schemes3↓20.00, 2825.00, 5430.00, 7335.00, 8540.00, 9245.00, 9750.00, 99UROI3.99, 178.00, 5810.82, 7513.36, 8615.75, 9218.98, 9622.46, 99TBLK3.84, 307.59, 6310.28, 7712.57, 8515.28, 9118.33, 9521.93, 98DCTMSB3.31, 315.57, 578.15, 7611.65, 8715.87, 9419.46, 9823.53, 99t-DWT (t=4)7.15, 739.87, 8613.91, 9418.68, 9824.16, 100∞, 100∞, 100TROI [12]12.36, 5114.92, 5215.13, 5315.16, 5315.18, 5315.19, 5315.19, 53VQ [13]20.25, 6322.34, 6223.14, 6223.35, 6223.39, 6423.40, 6523.40, 641Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Table 8
MSB attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked Images1,2→Schemes3↓20.00, 3125.00, 5430.00, 7035.00, 8140.00, 8845.00, 9250.00, 95UROI6.41, 267.04, 468.52, 669.85, 7811.51, 8613.21, 9114.93, 94TBLK7.59, 239.45, 4411.59, 6513.96, 7915.77, 8717.79, 9119.49, 94DCTMSB8.04, 3310.41, 5612.81, 7415.04, 8517.81, 9220.00, 9521.51, 97t-DWT(t=4)13.21, 7916.31, 9020.01, 9624.26, 9930.23, 10037.98, 100∞, 100DCT15.86, 9120.43, 9726.21, 9934.59, 10044.10, 10069.20, 100∞, 100TROI [12]16.25, 4516.72, 4917.10, 5017.39, 5117.46, 5317.47, 5317.47, 54VQ [13]19.20, 4923.28, 6124.83, 6825.25, 6825.33, 6625.34, 6625.34, 681Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Figure4(a) plots the LRR and Figure 4(b) plots the PSNR of the retrieved logos using Lena image and Monash logo against different JPEG quality factors. Figure 5(a) and Figure 5(b) plot the same using Elaine image and NUS logo. We found that the t-DWT approach performed the best among different approaches of the MSB-based scheme and existing TROI-based and VQ-based schemes. Both the LRR and PSNR increased with the increase of JPEG quality factor for the proposed scheme, while for the existing schemes they remained almost the same. While the proposed scheme always offered higher LRR; it outperformed the existing schemes in term of the PSNR when JPEG quality factor was greater than 70. This result is consistent with the observation made in motivation.(a) Logo retrieval rate and (b) PSNR using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)(a) Logo retrieval rate and (b) PSNR using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)


### 5.3.2. Classification Results (Robustness and Uniqueness)

In this section, we present and discuss classification results of the proposed and existing schemes. We can infer the overall robustness and uniqueness of each scheme from the respective classifier.Figures6, 7, 8, 9, 10, and 11 present classification results using SVM with linear kernel [27] and K-means clustering [28] separating the positive and negative classes of test cases, defined in the Section 4.3, for the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Though we conducted the experiments with all entries in C-, for clarity we show C-′, as defined in (13), instead of C- in Figure 6 to Figure 11. Table 9 shows the classification results obtained by SVM and K-means. If for a scheme a data point in C+corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be robust under that attack. Similarly, if for a scheme a data point in C-′ corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be unique under that attack. While the classes could be distinctively separated (no misclassification) with a large distance d between the support vectors for UROI (d=30.2), TBLK (d=31.4), and DCTMSB (d=31.4) approaches of the proposed scheme; the SVM classifier for t-DWT approach resulted in 5% positive misclassification with a large d=25.0 and the classifiers for the TROI-based (d=10.0) and VQ-based (d=9.2) schemes resulted in 20% and 30% positive misclassifications, respectively. We found no miss by K-means clustering for UROI, TBLK, and DCTMSB approaches, while for t-DWT approach and TROI- and VQ-based schemes, we found 35% positive, 26% negative, and 30% positive miss, respectively. Logo quality degradation due to torus-mapping and VQ coding constitute this problem for the existing schemes. Note that no misclassification and the large separation between positive and negative classes for UROI, TBLK, and DCTMSB approaches of the MSB-based scheme is so significant that simple PSNR-only (vertical) or LRR-only (horizontal) linear classifier can be used as well. Considering classification and clustering results and the distance from the SVM decision hyperplane to a corresponding entry of a particular attack, we took the decision of robustness and uniqueness tests. From Table 9, we see that UROI and DCTMSB approaches are highly robust and TBLK approach is moderately robust; while TROI-based scheme failed both robustness and uniqueness tests, and t-DWT approach and VQ-based scheme failed robustness test. We found that TBLK and t-DWT approaches are highly sensitive to geometric attacks.Table 9
Results and decisions for different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes by the support vector machines (SVM) [27] and K-means clustering algorithm [28].
SchemesNumber of miss (%)To individual attacks (robustness:h = high, m = moderate,Size of training setby SVMbyK-meansDistance1l = low, and n = no robustness; and f = uniqueness fail)2,3C+C−C+C−C+C−d0123456789Over4UROI201400 (0)0 (0)0 (0)0 (0)30.2hhhhhhhmmhhTBLK201400 (0)0 (0)0 (0)0 (0)31.5mhhhhllllmmDCTMSB20600 (0)0 (0)0 (0)0 (0)31.3mhhhhmmlmhht-DWT201401 (5)0 (0)7 (35)0 (0)25.1nhnmhnnnnhnTROI [12]201406 (30)0 (0)0 (0)36 (26)5.1n, fl, fn, fm, fl, fn, fn, fn, fn, fm, fn, fVQ [13]2010011 (55)0 (0)6 (30)0 (0)9.2nmnlhnnnnmn1Distance between support vectors.2Robustness: correctly classified by both SVM and K-means with h = high PSNR and LRR, m = moderate PSNR and LRR, and l = low PSNR and LRR; no robustness: n = any false negative by SVM or K-means; and uniqueness fail: f = any false positive by SVM or K-means.3Attack numbers 0-9 are referred using Table 3; and4Overall decision.Figure 6
SVM classification andK-means clustering results by the UROI approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=30.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 7
SVM classification andK-means clustering results by the TBLK approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.5 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 8
SVM classification andK-means clustering results by the DCTMSB approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.3 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 9
SVM classification andK-means clustering results by the t-DWT (t = 4) approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=25.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 10
SVM classification andK-means clustering results by the existing TROI-based scheme [12]. Note that the distance between support vectors by SVM [27] is d=5.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 11
SVM classification andK-means clustering results by the existing VQ-based scheme [13]. Note that the distance between support vectors by SVM [27] is D=9.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.


## 5.3.1. Robustness Results

In this section, we first present and discuss robustness results of the proposed and existing schemes under different attacks. We then detail the results for two attacks—JPEG which is the most common unintentional attack and newly proposed MSB attack which would defeat our scheme the most.Table2 shows the logo retrieval results using Lena image and Monash logo by different approaches of the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 4 shows the attacked images along with their corresponding retrieved logos using Lena image and Monash logo. Table 5 and Table 6 present the same, respectively, using Elaine image and NUS logo.Table 4
Attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓20.6622.9436.8910.6719.3628.2311.6319.4829.08UROI19.30, 9614.36, 9120.58, 99∞,10013.08, 8616.89, 9510.98, 7216.12, 8918.18, 97TBLK14.44, 8812.97, 8521.43, 9613.16, 9414.16, 8915.06, 9010.64, 7110.26, 7318.48, 94DCTMSB14.09, 9411.19, 8922.04, 9913.75, 8712.00, 8612.81, 9310.00, 7211.84, 8621.69, 98t-DWT (t=4)10.52, 8815.18, 9630.20, 1006.69, 7118.79, 9816.75, 9710.07, 7811.61, 91∞, 100TROI [12]14.73, 5413.85, 5614.97, 5315.19, 5316.94, 6214.86, 4813.20, 6113.37, 5314.68, 54VQ [13]14.79, 5823.67, 7323.12, 6015.57, 8317.10, 5520.65, 5320.72, 7119.74, 6423.38, 651Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).Table 5
Experimental results (PSNR in dB and LRR in %) by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes against various attacks using Elaine image and NUS logo.
AttacksPSNRProposed MSB-based schemeExisting schemesUROITBLKDCTMSBt-DWT1TROI [12]VQ [13]PSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRPSNRLRRAffine (XY)518.6913.869017.338814.488617.849216.405621.1261Avg. filter234.0919.179822.909724.439827.019917.515625.3269BPM (25 dB)21.9912.798815.618414.578617.259316.625523.2955Cropping9.64∞10041.959916.558112.177017.47557.7848Gauss. (G) filter242.7423.589926.519927.329933.0910017.505525.3568G filter2 & noise20.0512.848815.838517.159225.469915.595525.2668G noise20.0912.578815.808516.929225.689915.655525.1970Histogram equal.18.2316.979619.829518.379421.209714.725622.7665JPEG (quality 0)25.1413.698917.748614.638620.269616.855821.1370JPEG (quality 5)28.0216.209419.539117.009122.279717.145625.0265LSRD314.9410.997512.287612.237511.847112.305315.5758Median filter224.3713.959118.078814.978727.349916.535625.2767Motion filter225.5414.619319.008418.549419.419517.145524.3565Print-copy-scan19.5613.499016.048815.649215.759015.995620.2750Print-scan22.3215.489419.719320.439521.399616.325724.6268MSB (30 dB)30.008.526611.596512.817420.019617.105024.8368MSB (35 dB)35.009.857813.967915.048524.269917.395125.2568MSB (40 dB)40.0011.518615.778717.819230.2310017.465325.3366Rot.-crop (2°)17.6813.848416.268514.368114.898615.135620.0865Rot.-scale (2°)17.5813.798416.068514.268114.858615.105619.9266Rot.-scale (5°)11.5311.737611.297611.106811.246513.295413.0562RCR4 (1 in 10)525.2014.489218.578915.728929.289916.685625.3469Salt & pepper22.6025.619925.239934.7210022.989916.245425.0472Scaling (×0.5)525.0914.399218.298915.9790∞10016.725725.3667Scaling (×2)525.6614.249218.638915.508928.5810016.765725.3168Self similarities25.4814.639218.448915.338829.5210016.825625.3668Small rand. dist.18.5511.998516.128413.628417.249115.105420.4067unZign29.7919.029723.809724.039833.0910017.265525.3568Wiener filter236.5220.109820.969725.129927.909915.205224.45671Decomposition level t=4.23×3 window.3Latest small random distortion.4Row-col-removal.5Resized to original.Table 6
Attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
Affine2BPM3Blurring4Crop.5Hist. Eq.JPEG (5)PCS6Rot.-crop 2°unZignAttacks1→Schemes7↓18.6921.9942.749.6418.2328.0219.5617.6829.79UROI13.86, 9012.79, 8823.58, 99∞, 10016.97, 9616.20, 9413.49, 9013.84, 8419.02, 97TBLK17.33, 8815.61, 8426.51, 9941.95, 9919.82, 9519.53, 9116.04, 8816.26, 8523.80, 97DCTMSB14.48, 8614.57, 8627.32, 9916.55, 8118.37, 9417.00, 9115.64, 9214.36, 8124.03, 98t-DWT (t=4)17.84, 9217.25, 9333.09, 10012.17, 7021.20, 9722.27, 9715.75, 9014.89, 8633.09, 100TROI [12]16.40, 5616.62, 5517.50, 5517.47, 5514.72, 5617.14, 5615.99, 5615.13, 5617.26, 55VQ [13]21.12, 6123.29, 5525.35, 687.78, 4822.76, 6525.02, 6520.27, 5020.08, 6525.35, 681Attacked images with PSNR (dB).2Resized to original after XY-shearing.3PSNR of similar blocks (4×4) ≥25 dB.4Gaussian filter.5Cropping excluding ROI.6Print-copy-scan.7Retrieved logos with PSNR (dB) and LRR (%).We observed that all the approaches of the proposed scheme performed almost the same except thet-DWT approach which was sensitive to geometric distortions. In contrast, both the TROI-based and VQ-based schemes were very much sensitive to geometric attacks and the former did not survive under high JPEG lossy compression (quality less than 10). In most of the cases, the PSNR and in all the cases the LRR of the retrieved logos by the proposed scheme were higher than those by the TROI-based scheme. In the remaining few cases, the PSNR of the retrieved logos by the proposed scheme were lower. In most of the cases, the LRR by the MSB-based scheme was higher than the VQ-based scheme; while in many cases, the PSNR by the latter was higher due to its VQ coding. However, it is no way an indication to the superiority of the existing schemes for these kinds of attacks; because the logo quality degrades severely during the torus-mapping and VQ coding, as shown in Figures 3(e)–3(h), and as a consequence the PSNR and LRR remained almost unchanged irrespective of logos.Table7 presents the MSB-attacked images along with their corresponding retrieved logos using Lena image and Monash logo by the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Table 8 presents the same using Elaine image and NUS logo. Among the approaches of the proposed scheme, DWT-based approach showed the highest resistance against the MSB attack. The proposed scheme survived down to PSNR 30 dB of the attacked image. Lee and Chen [13] argued that the visual quality of the image is unacceptable to the human eyes if the PSNR is less than 30 dB. Moreover, we observed that the proposed scheme performed better if the PSNR of the MSB attacked image increases, while for the existing schemes the PSNR and LRR of the retrieved logos remained almost unchanged irrespective of the PSNR of the attacked images. However, since the distortion in an image is more noticeable in the mid-gray region and sensitivity changes parabolically as the gray value fluctuates on the both sides of mid-gray level [7], as a precaution to the MSB attack, we suggest excluding mid-gray pixels during signature calculation.Table 7
MSB attacked images along with their corresponding retrieved logos using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked1 Images2→Schemes3↓20.00, 2825.00, 5430.00, 7335.00, 8540.00, 9245.00, 9750.00, 99UROI3.99, 178.00, 5810.82, 7513.36, 8615.75, 9218.98, 9622.46, 99TBLK3.84, 307.59, 6310.28, 7712.57, 8515.28, 9118.33, 9521.93, 98DCTMSB3.31, 315.57, 578.15, 7611.65, 8715.87, 9419.46, 9823.53, 99t-DWT (t=4)7.15, 739.87, 8613.91, 9418.68, 9824.16, 100∞, 100∞, 100TROI [12]12.36, 5114.92, 5215.13, 5315.16, 5315.18, 5315.19, 5315.19, 53VQ [13]20.25, 6322.34, 6223.14, 6223.35, 6223.39, 6423.40, 6523.40, 641Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Table 8
MSB attacked images along with their corresponding retrieved logos using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes.
MSB Attacked Images1,2→Schemes3↓20.00, 3125.00, 5430.00, 7035.00, 8140.00, 8845.00, 9250.00, 95UROI6.41, 267.04, 468.52, 669.85, 7811.51, 8613.21, 9114.93, 94TBLK7.59, 239.45, 4411.59, 6513.96, 7915.77, 8717.79, 9119.49, 94DCTMSB8.04, 3310.41, 5612.81, 7415.04, 8517.81, 9220.00, 9521.51, 97t-DWT(t=4)13.21, 7916.31, 9020.01, 9624.26, 9930.23, 10037.98, 100∞, 100DCT15.86, 9120.43, 9726.21, 9934.59, 10044.10, 10069.20, 100∞, 100TROI [12]16.25, 4516.72, 4917.10, 5017.39, 5117.46, 5317.47, 5317.47, 54VQ [13]19.20, 4923.28, 6124.83, 6825.25, 6825.33, 6625.34, 6625.34, 681Images with PSNR <30 dB are unacceptable [13].2With target PSNR (dB) and MSB similarity rate (%).3Retrieved logos with PSNR (dB) and LRR (%).Figure4(a) plots the LRR and Figure 4(b) plots the PSNR of the retrieved logos using Lena image and Monash logo against different JPEG quality factors. Figure 5(a) and Figure 5(b) plot the same using Elaine image and NUS logo. We found that the t-DWT approach performed the best among different approaches of the MSB-based scheme and existing TROI-based and VQ-based schemes. Both the LRR and PSNR increased with the increase of JPEG quality factor for the proposed scheme, while for the existing schemes they remained almost the same. While the proposed scheme always offered higher LRR; it outperformed the existing schemes in term of the PSNR when JPEG quality factor was greater than 70. This result is consistent with the observation made in motivation.(a) Logo retrieval rate and (b) PSNR using Lena image and Monash logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)(a) Logo retrieval rate and (b) PSNR using Elaine image and NUS logo by different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes under different JPEG quality factors.
(a)(b)


## 5.3.2. Classification Results (Robustness and Uniqueness)

In this section, we present and discuss classification results of the proposed and existing schemes. We can infer the overall robustness and uniqueness of each scheme from the respective classifier.Figures6, 7, 8, 9, 10, and 11 present classification results using SVM with linear kernel [27] and K-means clustering [28] separating the positive and negative classes of test cases, defined in the Section 4.3, for the MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes. Though we conducted the experiments with all entries in C-, for clarity we show C-′, as defined in (13), instead of C- in Figure 6 to Figure 11. Table 9 shows the classification results obtained by SVM and K-means. If for a scheme a data point in C+corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be robust under that attack. Similarly, if for a scheme a data point in C-′ corresponding to an attack is misclassified by a classifier, then the scheme is decided not to be unique under that attack. While the classes could be distinctively separated (no misclassification) with a large distance d between the support vectors for UROI (d=30.2), TBLK (d=31.4), and DCTMSB (d=31.4) approaches of the proposed scheme; the SVM classifier for t-DWT approach resulted in 5% positive misclassification with a large d=25.0 and the classifiers for the TROI-based (d=10.0) and VQ-based (d=9.2) schemes resulted in 20% and 30% positive misclassifications, respectively. We found no miss by K-means clustering for UROI, TBLK, and DCTMSB approaches, while for t-DWT approach and TROI- and VQ-based schemes, we found 35% positive, 26% negative, and 30% positive miss, respectively. Logo quality degradation due to torus-mapping and VQ coding constitute this problem for the existing schemes. Note that no misclassification and the large separation between positive and negative classes for UROI, TBLK, and DCTMSB approaches of the MSB-based scheme is so significant that simple PSNR-only (vertical) or LRR-only (horizontal) linear classifier can be used as well. Considering classification and clustering results and the distance from the SVM decision hyperplane to a corresponding entry of a particular attack, we took the decision of robustness and uniqueness tests. From Table 9, we see that UROI and DCTMSB approaches are highly robust and TBLK approach is moderately robust; while TROI-based scheme failed both robustness and uniqueness tests, and t-DWT approach and VQ-based scheme failed robustness test. We found that TBLK and t-DWT approaches are highly sensitive to geometric attacks.Table 9
Results and decisions for different approaches of the proposed MSB-based scheme and existing TROI-based [12] and VQ-based [13] schemes by the support vector machines (SVM) [27] and K-means clustering algorithm [28].
SchemesNumber of miss (%)To individual attacks (robustness:h = high, m = moderate,Size of training setby SVMbyK-meansDistance1l = low, and n = no robustness; and f = uniqueness fail)2,3C+C−C+C−C+C−d0123456789Over4UROI201400 (0)0 (0)0 (0)0 (0)30.2hhhhhhhmmhhTBLK201400 (0)0 (0)0 (0)0 (0)31.5mhhhhllllmmDCTMSB20600 (0)0 (0)0 (0)0 (0)31.3mhhhhmmlmhht-DWT201401 (5)0 (0)7 (35)0 (0)25.1nhnmhnnnnhnTROI [12]201406 (30)0 (0)0 (0)36 (26)5.1n, fl, fn, fm, fl, fn, fn, fn, fn, fm, fn, fVQ [13]2010011 (55)0 (0)6 (30)0 (0)9.2nmnlhnnnnmn1Distance between support vectors.2Robustness: correctly classified by both SVM and K-means with h = high PSNR and LRR, m = moderate PSNR and LRR, and l = low PSNR and LRR; no robustness: n = any false negative by SVM or K-means; and uniqueness fail: f = any false positive by SVM or K-means.3Attack numbers 0-9 are referred using Table 3; and4Overall decision.Figure 6
SVM classification andK-means clustering results by the UROI approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=30.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 7
SVM classification andK-means clustering results by the TBLK approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.5 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 8
SVM classification andK-means clustering results by the DCTMSB approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=31.3 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 9
SVM classification andK-means clustering results by the t-DWT (t = 4) approach of the proposed MSB-based scheme. Note that the distance between support vectors by SVM [27] is d=25.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 10
SVM classification andK-means clustering results by the existing TROI-based scheme [12]. Note that the distance between support vectors by SVM [27] is d=5.1 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.Figure 11
SVM classification andK-means clustering results by the existing VQ-based scheme [13]. Note that the distance between support vectors by SVM [27] is D=9.2 and cluster 1 and cluster 2 are positive and negative clusters, respectively, by K-means clustering algorithm [28]. Attack numbers 0–9 are referred using Table 3.


## 5.4. Comparisons and Discussions

Table10 presents comparisons among the different approaches of the proposed MSB-based scheme and the existing TROI-based [12] and VQ-based [13] schemes. The MSB-based scheme possesses transparency because it does not embed any information to the published image. UROI, TBLK, and DCTMSB approaches are robust, while t-DWT approach failed. In contrast, due to very low PSNR and LRR both TROI-based and VQ-based schemes are not robust and TROI-based scheme failed uniqueness test. The security of the MSB-based scheme is the same as the security of the digital signature and the digital timestamp. The classification and clustering results showed that UROI, TBLK, and DCTMSB approaches are unambiguous due to correctly classification by SVM with a large d between the support vectors and no miss by K-means, while t-DWT approach is ambiguous due to positive misclassification by both SVM and TROI. In contrast, the existing schemes are ambiguous because of high positive misclassifications. In our experiments, we also used the polynomial kernel for TROI-based and VQ-based schemes and found high misclassifications. The MSB-based scheme is not blind as the TTP finds whether images are disputable by comparing signatures calculated from them before taking the decision based on the timestamps. The TROI-based scheme is also not blind too; because as the published image does not contain any information, the original image must be used to find out the corresponding signature from the owner’s database. On the other hand, the VQ-based scheme is blind as it adds the signature with the image header before publishing. However, this signature addition not only increases the file size but also creates severe problem of losing copyright if an attacker removes the signature from the image header. The MSB-based scheme can handle multiple logos (multiple watermarking) like the existing schemes. An image may be signed using the same or different types of logos by the same owner.Table 10
Comparisons of different approaches of the proposed scheme and existing schemes [12, 13].
IssuesExistingApproaches of the proposed MSB-based schemeTROI [12]VQ [13]UROITBLKDCTMSBt-DWTTransparencyyesyesyesyesyesyesRobustnessnonohighmoderatehighnoUniquenessnoyesyesyesyesyesUnambiguousnonoyesyesyesnoSecurityyesyesyesyesyesyesBlindnesssemi-blindblindsemi-blindsemi-blindsemi-blindsemi-blindMultiple logoyesyesyesyesyesyesPublicly verifiablenoyesnonononoStirMark resistancenonomoderatelowmoderatenoMSB attack resistancemoderatehighmoderatemoderatemoderatehighScalability1nonoyesyesyesyesSignature addition2noyesnonononoJPEG quality < 10lowhighhighhighhighhighOperation domainspatialDWTspatialspatialDCTDWTTime complexityhighhighconstantlowlowlowAlgorithm simplicitynonoyesyesyesyesRegion-of-interest usedyesnoyesnonono1Signature calculation using different types of image and logo.2With image header.The scheme by Lee and Chen [13] is publicly verifiable as it adds the signature with the image header. On the other hand, the ownership dispute is handled through the TTP by the MSB-based scheme. In TROI-based scheme, the owner keeps the security parameters secret himself. The existing schemes and t-DWT approach is not much robust as they offer low PSNR and LRR against stirMark attacks. However, t-DWT approach and VQ-based schemes showed high robustness to MSB attack, while UROI, TBLK, and DCTMSB approaches and TROI-based scheme showed moderate robustness. Any type and size of logos can be signed with an 8-bit gray-scale image by the MSB-based scheme, while the TROI-based and VQ-based schemes can sign only 8-bit gray-scale logos. The existing schemes are highly time consuming due to use of torus mapping and VQ encoding. In contrast, the MSB-based scheme is simple due to use of the MSB-plane; especially, the UROI approach is the simplest as it does not involve any transform domain operation. The proposed scheme also presents a comprehensive TTP management policy in order to secure the e-commerce.


## 6. Conclusions

This paper has proposed an MSB-based image copyright protection scheme, which relies on a TTP to offer the following advantages over the existing schemes: (i) any type and size of images and logos can be used; (ii) extremely low computational complexity, due to use of exclusive-OR operations for signature calculation, enables real time applications; (iii) robust to almost all kinds of attacks; (iv) the comprehensive TTP management policy ensures secure e-commerce.The existing signature-based schemes that can sign images with multibit logos are not robust against geometric attacks and neither a linear nor a polynomial kernel of the SVM can classify them correctly. Among the approaches of the proposed MSB-based scheme,t-DWT approach is the best against the newly proposed MSB attack and JPEG. Nevertheless, this approach fails to be correctly classified due to its weakness against geometric attacks. On the other hand, classifiers designed by the UROI, TBLK, and DCTMSB approaches are excellent in the sense that they offer no misclassification and simple PSNR-only or LRR-only classifier can be used.



---

*Source: 875759-2012-05-29.xml*