A Benchmark for 3D Mesh Watermarking
5 Pages

A Benchmark for 3D Mesh Watermarking


Downloading requires you to have access to the YouScribe library
Learn all about the services we offer


2010 Shape Modeling International Conference
A Benchmark for 3D Mesh Watermarking
1 1 2 1Kai WANG , Guillaume Lavoue´ , Florence Denis , Atilla Baskurt Xiyan He
Universite´ de Lyon, CNRS Institut Charles Delaunay (FRE 2848 CNRS)
1 2INSA-Lyon /site´ Lyon 1 , LIRIS, UMR5205 Universite´ de Technologie de Troyes
Villeurbanne, France Troyes, France
Email:fkwang, glavoue, fdenis, abaskurtg@liris.cnrs.fr Email: xiyan.he@utt.fr
measure the geometric distance between original and wa-Abstract—This paper presents a benchmarking system
for the evaluation of robust mesh watermarking methods. termarked models, and to conduct attacks on watermarked
The proposed benchmark has three different components: a meshes. The authors also propose to use a four-element
“standard” mesh model collection, a software tool and two
structure to report the overall performance of a robust
application-oriented evaluation protocols. The software tool
scheme. Compared to their proposal, our contributionsintegrates both geometric and perceptual measurements of
are threefold: 1) We provide a publicly available datathe distortion induced by watermark embedding, and also
the implementation of a variety of attacks on watermarked set of mesh models and an open-source software tool for
1meshes. The two evaluation protocols define the main steps the evaluation of robust mesh watermarks . The provided
to follow when conducting the evaluation experiments. The
software contains a number of typical attacks, a ...



Published by
Reads 160
Language English
distortion metrics, attacks and evaluation methodologies and its watermarked version. The robustness indicates how when reporting their experimental results. Therefore, it is resistant the watermark is against various routine opera- necessary to propose a benchmarking system to the mesh tions on the wed content. A secure watermarking watermarking community, with the objective to attain a scheme should be able to withstand the malicious attacks fair and easy comparison between different algorithms. that aim to break down the whole watermarking-based Several benchmarking systems have been constructed copyright protection system through, for instance, secret for evaluating image watermarks, such as Stirmark [2], key disclosure or inversion of the watermark embedding Checkmark [3] and Optimark [4]. In contrast, to the best procedure. In the proposed benchmark, we consider only of our knowledge, the benchmarking of 3D mesh water- the payload, distortion and robustness evaluations, while marks was addressed only by Bennour and Dugelay [5]. 1They propose to use some existing software packages to Available at http://liris.cnrs.fr/meshbenchmark/ 978-0-7695-4072-6/10 $26.00 © 2010 IEEE 231 DOI 10.1109/SMI.2010.33 6 0discarding the security metric. The main reason is that local windows p and q (respectively inM andM ) is the research on mesh watermarking is still in its early defined as follows: stage [1] and until now the community has been interested 13 3 3 3d (p;q) = (0:4 L(p;q) +0:4 C(p;q) +0:2 S(p;q) ) ;LMSDM in achieving robustness against connectivity attacks (e.g. (3) surface simplification and remeshing) while paying little where L, C and S represent respectively curvature, con- attention on security, a rather high-level requirement. trast and structure comparison functions (please refer to [7] Finally, when reporting the evaluation results, the authors for more details). The global MSDM distance between two 0should also indicate whether their scheme is blind, semi- meshesM andM (both havingn vertices), is defined by blind or non-blind. a Minkowski sum of the meshes’n local MSDM distances When evaluating a robust mesh watermarking scheme measured on their n vertices: !1by using the above metrics, we also need a well-defined n 3X0 1 3protocol which indicates the steps to follow when conduct- d (M;M ) = d (p ;q ) 2 [0;1): (4)MSDM LMSDM i i n i=1ing the experiments. Before presenting our application- oriented evaluation protocols in Section 5, we will first Its value tends toward 1 (theoretical limit) when the explain how we measure the distortion induced by water- measured objects are visually very different and is equal to mark embedding and the various attacks against which we 0 for identical objects. The main reasons for choosing this would like to test the robustness. perceptual distortion metric are its strong robustness and its high correlation with the subjective evaluation results III. DISTORTION METRICS given by human beings [7]. IV. ATTACKSThe watermark embedding process introduces some amount of distortion to the original cover mesh. This In general, there are three kinds of routine attacks on a distortion can be measured geometrically or perceptually. watermarked mesh: file attack, geometry attack and con- For the geometric measurement, we propose to use the nectivity attack. In the following, we will give examples maximum root mean square error (MRMS). In general, for each kind of attack and present the corresponding the root mean square error (RMS) from one 3D surfaceS implementations in our benchmarking software. 0 to another 3D surface S is defined as A. File attack s Z Z 0 1 0 2 This attack reorders the vertices and/or the facets in thed (S;S ) = d p;S dS; (1)RMS jSj p2S mesh file, and does not introduce any modification to the mesh shape. A robust mesh watermark should be perfectly where p is a point on surface S,jSj is the area of S, and 0 invariant to this kind of attack. When carrying out thed(p;S ) denotes the point-to-surface distance between p 0 file attack, the benchmarking software uses a randomly andS . This RMS distance is not symmetric and generally 0 0 selected key to rearrange the vertex and facet indices in we haved (S;S ) =d (S ;S). Therefore, we canRMS RMS their corresponding lists in the mesh file. define the MRMS distance between a cover meshM and 0 its watermarked versionM as B. Geometry attack 0 0 0 In a geometry attack, only the vertex coordinates ared (M;M ) = max d (M;M );d (M;M) :MRMS RMS RMS modified while the mesh connectivity (i.e. the adjacency(2) relationship between vertices) is kept unchanged. OurDifferent from the simple vertex-to-vertex distance metrics benchmarking software integrates the implementation of(e.g. the vertex coordinates PSNR), MRMS measures the the following geometry attacks.surface-to-surface distance between two meshes. The dis- Similarity transformation. This operation includestortion measured by MRMS is more accurate, especially translation, rotation, uniform scaling and their combina-when the two meshes under comparison do not have tion. Like the above vertex/facet reordering operation, thethe same connectivity configuration. We have included similarity transformation always keeps the mesh shapethe legacy MRMS implementation of Metro [6] in our intact. Actually, these two kinds of operations are jointlybenchmarking software. called content-preserving attacks, through which a robustIt is well known that the geometric surface-to-surface watermark, or even a fragile watermark, should be able todistances, such as MRMS, do not correctly reflect the survive. In our implementation, in each run of the similar-visual difference between two meshes [7]. Thus, we need ity transformation, the watermarked mesh is successivelyanother perceptual metric to measure the visual distortion subject to a random translation, a random rotation and ainduced by watermark embedding. For this purpose, we random uniform scaling.have considered the mesh structural distortion measure Noise addition. This attack aims to simulate the arti-(MSDM) proposed by Lavoue´ et al. [7], and have in- facts introduced during mesh generation and the errorstegrated it in the benchmarking software. This metric induced during data transmission. We propose to addfollows the concept of structural similarity recently intro- pseudo-random noises on vertex coordinatesx accordingiduced by Wang et al. [8] for 2D image quality assessment, to the following equation (resp. y , z ):i iand well reflects the perceptual distance between two 3D 0objects. The local MSDM distance between two mesh x =x +a :d; (5)i ii 232 Bunny model (V = 10%).where d denotes the average distance from vertices to cr object center, anda is the noise strength forx . The objecti i Finally, it is worth pointing out that it is important to center is calculated by using the analytic and continuous repeat the attacks with a random nature (i.e. file attack, volume moments of the mesh [9], which is much more similarity transformation, noise addition and cropping), for robust than simply calculating it as the average position at least 3 times, in order to ensure the reliability of the of the mesh vertices [10]. a is a pseudo-random number obtained robustness evaluation results.i uniformly distributed in interval [ A;A], with A the V. EVALUATION PROTOCOLSmaximum noise strength. Figure 1.(b) illustrates a noised Bunny model (A = 0:30%). The objective of a watermark evaluation protocol is Smoothing. Surface smoothing is a common operation to define the main steps to follow when conducting the used to remove the noise introduced during the mesh experimental assessment of a watermarking scheme. In the generation process through 3D scanning. For mesh wa- case of image watermarking, the authors of Stirmark [2] termark benchmarking, we choose to carry out Laplacian propose to first fix the watermark payload at about 70 bits smoothing [11] on watermarked meshes, with different and also to limit the induced distortion to be higher than 38 iteration numbersN while fixing the deformation factor dB in terms of PSNR. After that, Stirmark system carriesitr as 0:10. Figure 1.(c) shows a smoothed Bunny model out a series of attacks on the watermarked image. Then, the ( = 0:10;N = 30). user tries to extract watermarks from the obtained attackeditr Vertex coordinates quantization. This operation is stego images. Finally, several plots or tables are reported, which indicate the robustness metric (e.g. bit error ratelargely used in mesh compression. Under aR-bit uniform of the extracted watermark) versus the amplitudes of thequantization, the x (resp. y, z) coordinate of each vertex Ris rounded to one of the 2 quantized levels. different kinds of attacks. We define here two similar protocols for the evaluation C. Connectivity attack of robust mesh watermarking schemes. We call the first protocol perceptual-quality-oriented and the second oneIn a connectivity attack, the mesh connectivity infor- geometric-quality-oriented. The motivation for establish-mation, i.e. the adjacency relationship between vertices, ing two different protocols is that different mesh-basedis changed. Meanwhile, the coordinates of the original applications have very different restrictions on the geo-vertices may also be modified. We have implemented the metric and the perceptual distortions induced by water-following connectivity attacks in the software tool. mark embedding. For example, for the meshes used inSimplification. The original version of a mesh model digital entertainment, we should first of all ensure that(especially those obtained by a 3D scanning) usually has a the induced distortion is not annoying to human eyes (i.e.very high complexity, sometimes with more than 1 million the watermarked model should have a very high visualvertices. This high complexity is necessary to ensure a quality), while the amount of induced geometric distortiongood precision. In practical applications, the watermark is is less important. On the contrary, for the meshes usedoften embedded in the original complex model, and then in computer-aided design and medical imaging, it is oftenthe mesh is simplified so as to adapt to the capacity of the required that the geometric distortion should be very small,available resources. In the benchmarking software we inte- while the visual quality of the watermarked model isgrated the mesh simplification algorithm of Lindstrom and relatively less important.Turk [12], which provides a good trade-off between the The perceptual-quality-oriented evaluation protocolprecision of the simplified model and the computational consists of the following steps:efficiency. The user can designate the edge reduction ratios 1) Embed a watermark W in a test meshM by usingE of the simplification operations. Figure 1.(d) showssim a secret key K to obtain a watermarked modela simplified Bunny model (E = 95%).sim 0 M ; make sure that the induced perceptual distortionSubdivision. In this operation, vertices and edges are d 0:20 and the induced geometric distor-added to the original mesh to obtain a modified version MSDM tion d 0:08%:l , where l denotes thethat is normally smoother and of a higher visual quality. MRMS bbd bbd diagonal length of the mesh’s bounding box.We suggest to test the watermark robustness against three 2) Carry out the suggested attacks listed in Table I on thetypical subdivision schemes, always with one iteration: thep 0 stego meshM , by using the provided benchmarkingsimple midpoint scheme, the 3 scheme and the Loop software.scheme [13]. 3) Try to detect/extract the embedded watermark WCropping. In this attack, one part of the watermarked from each of the obtained attacked stego models andmesh is cut off and thus lost. This attack happens when record the detection/extraction robustness result, i.e.we create a new model by combining parts extracted from the confidence level of the existence of W in theseveral other objects. We propose to conduct the copping tested model or the bit error rate of the extractedattacks with different approximative vertex cropping ratios watermark.V . In our implementation, for each ratio, 3cr 4) For detectable schemes, also try to detect a randomattacked models are generated. These models are obtained ~watermark W from each of the obtained attackedby cropping the original stego mesh along 3 randomly stego models and record the detection algorithmselected orthogonal axes. Figure 1.(e) illustrates a cropped 233 Figure 1. The Bunny model and four attacked versions: (a) the original mesh with 34835 vertices and 104499 edges; (b) after noise addition (A = 0:30%); (c) after Laplacian smoothing ( = 0:10;N = 30); (d) after simplification (E = 95%); (e) after cropping (V = 10%).itr sim cr Table I characteristics (ROC) curves (i.e. the curves describingATTACKS USED IN THE EVALUATION PROTOCOLS. the relationship between the false positive rate and theAttack Parameter Parameter values false negative rate of the watermark detection) under eachFile attack times 3 Similarity transformation times 3 kind of attack are plotted as the evaluation results. Finally, aNoise addition A 0:05%, 0:10%, 0:30%, 0:50% note that sometimes it is advised to also test the ROCSmoothing ( = 0:10) N 5, 10, 30, 50itr Quantization R 11, 10, 9, 8, 7 performance (in addition to the BER performance) of 10%, 30%, 50%, 70%, Simplification Esim a readable watermarking scheme by considering it as ab90%, 95%, 97:5% p detectable scheme.Subdivision (1 iteration) scheme midpoint, 3, Loop Cropping V 10%, 30%, 50%cr When carrying out comparison between different read- a For each noise amplitude, it is necessary to repeat 3 times. b able schemes, we have to ensure that they have the sameThe ratio 97:5% is only for large meshes having 100K vertices. payload. It is proposed to set the payload to one of the following values: 16 bits, 32 bits, 64 bits and 96 bits. Compared to the Stirmark protocol which suggests output, i.e. the confidence level of the existence of to fix the payload at around 70 bits, in our protocols it~W in the tested model. is acceptable that a readable mesh watermarking scheme 5) Repeat steps 1-4 for several times with different has a relatively low payload such as 16 or 32 bits. randomly selected watermark sequences and keys. We have loosened the requirement mainly based 6) Repeat steps 1-5 for each test mesh from the standard on the observations that robust mesh watermarking is a data set. challenging task due to many particular difficulties and The two distortion thresholds in the above protocol (i.e. that the relevant research is still in its early stage [1]. 0:20 ford and 0:08%:l ford ) ensure thatMSDM bbd MRMS Consequently, it is reasonable that the evaluation protocols the obtained stego model is of very high visual quality for mesh watermarking should be less stringent than those and that the cover mesh is not too much deformed. The for image, audio and video watermarking. geometric-quality-oriented protocol consists of the same Finally, concerning the dataset collection, we have se- steps; the difference is that we have different constraints lected several representative meshes (with different num- on the induced geometric and perceptual distortions as bers of vertices and different shape complexities, and used follows: d 0:02%:l and d 0:30. TheMRMS bbd MSDM in different applications) as test models, and also acquired constraint on d guarantees that only a very smallMRMS the permission to post them on our public server. These amount of geometric distortion is introduced to the cover models are: Bunny (34835 vertices), Venus (100759 ver- mesh. The constraint ond avoids this small-amountMSDM tices), Horse (112642 vertices), Dragon (50000 vertices), distortion (sometimes of high frequency) from degrading Rabbit (70658 vertices), Ramesses (826266 vertices), Cow too much the visual quality of the watermarked object. We (2904 vertices), Hand (36619 vertices), Casting (5096 are prepared to adjust these four thresholds according to vertices), and Crank (50012 vertices). the feedbacks from the community. Finally, note that the two MSDM thresholds in the protocols correspond to the VI. COMPARISON OF TWO RECENT ALGORITHMS calculation in which the radius parameter is fixed as 0:005 In order to test the usability of the proposed benchmark, [7]. This parameter is used to define the local window size we have used it to evaluate and compare two recent for the local MSDM calculation given in Eq. (3). blind and robust mesh watermarking schemes: the method Both readable (multi-bit) and detectable (one-bit) wa- of Cho et al. [14] that is based on modification of the termarking schemes can be tested by using our protocols. mean value of the histogram of vertex norms, and the For readable schemes, we suggest to repeat the watermark method of Wang et al. [10] that is based on modification embedding for at least 5 times on each model and report of the mesh local volume moments. Table II presents the averages of the watermark extraction bit error rates the baseline evaluation results of the two methods on (BER) under the different attacks. For detectable schemes, Venus model, under both protocols. The corresponding it is suggested that for each test model we repeat the wa- robustness evaluation results are presented in Table III, termark embedding for at least 50 times by using different in which we also list some average BER values under watermark sequences and keys. The receiver operating 234 Table II expect receiving feedbacks from the mesh watermarking BASELINE EVALUATION RESULTS OF THE TWO METHODS. community, based on which we could further improve the Protocol Perceptual Geometric usability of the benchmark. Method Cho’s Wang’s Cho’s Wang’s WM payload (bits) 64 64 64 64 ACKNOWLEDGMENTS Embedding time (s) 7:6 439:9 11:6 377:6 We would like to thank Prof. M. Levoy for granting us theExtraction time (s) < 1:0 3:3 < 1:0 3:5 permission to post the Bunny and Dragon models on our publicd (w.r.t.l ) 0:0080% 0:069% 0:012% 0:018%MRMS bbd d 0:19 0:14 0:29 0:09MSDM server. The Venus, Horse and Rabbit models are the courtesies of the Cyberware Inc., and the Ramesses, Cow, Hand, Casting and Table III Crank models are the courtesies of the AIM@SHAPE project. ROBUSTNESS COMPARISON BETWEEN THE TWO METHODS. We are grateful to Dr. P. Cignoni for allowing us to integrate the Metro tool in our benchmarking software.Protocol) Perceptual Geometric This work is in part supported by China Scholarship Coun-Cho’s Wang’s Cho’s Wang’s Attack+ BER BER BER BER cil of the Chinese government and French National Research Agency (ANR) through COSINUS program (project COLLAVIZFile attack 0 0 0 0 n ANR-08-COSI-003).Similarity transformation 0 0 0 0 NoiseA = 0:05% 0:01 0 0 0:02 REFERENCESA = 0:10% 0:03 0:01 0:01 0:15 NoiseA = 0:30% 0:13 0:08 0:10 0:29 [1] K. Wang, G. Lavoue,´ F. Denis, and A. Baskurt, “A compre-NoiseA = 0:50% 0:28 0:16 0:24 0:40 SmoothingN = 5 0:10 0 0:06 0:06 hensive survey on three-dimensional mesh watermarking,”itrN = 10 0:23 0:01 0:16 0:18itr IEEE Trans. on Multimedia, vol. 10, no. 8, pp. 1513-1527, SmoothingN = 30 0:38 0:07 0:34 0:39itr 2008.N = 50 0:45 0:14 0:42 0:51itr [2] F. A. P. Petitcolas, R. J. Anderson, and M. G. Kuhn, “AttacksQuantizationR = 11 0 0 0 0:01R = 10 0:04 0:01 0:02 0:17 on copyright marking systems,” in Proc. of the Int. WorkshopR = 9 0:14 0:01 0:06 0:27 on Information Hiding, 1998, pp. 218-238. QuantizationR = 8 0:26 0:05 0:18 0:39 [3] S. Pereira, S. Voloshynovskiy, M. Madueno, S. Marchand-R = 7 0:46 0:17 0:41 0:53 Average geometry attacks 0.18 0.05 0.14 0.24 Maillet, and T. Pun, “Second generation benchmarking and Subdivision Midpoint 0:04 0 0:02 0 application oriented evaluation,” in Proc. of the Int. Work-p Subdivision 3 0:14 0 0:09 0:01 shop on Information Hiding, 2001, pp. 340-353. Subdi Loop 0:16 0 0:09 0:01 [4] V. Solachidis, A. Tefas, N. Nikolaidis, S. Tsekeridou, A. SimplificationE = 10% 0:01 0 0 0sim Nikolaidis, and I. Pitas, “A benchmarking protocol for wa-E = 30% 0:05 0 0:03 0simE = 50% 0:18 0 0:07 0:02 termarking methods,” in Proc. of the IEEE Int. Conf. onsim SimplificationE = 70% 0:33 0 0:14 0:02sim Image Process., 2001, vol. 3, pp. 1023-1026.E = 90% 0:23 0:01 0:12 0:08sim [5] J. Bennour and J.-L. Dugelay, “Toward a 3D watermarkingE = 95% 0:38 0:01 0:27 0:17sim SimplificationE = 97:5% 0:47 0:05 0:42 0:32 benchmark,” in Proc. of the IEEE Int. Workshop on Multi-sim CroppingV = 10% 0:50 0:51 0:50 0:51cr media Signal Process., 2007, pp. 369-372. CroppingV = 30% 0:53 0:49 0:51 0:48cr [6] P. Cignoni, C. Rocchini, and R. Scopigno, “Metro: Measur-V = 50% 0:51 0:49 0:52 0:49cr ing error on simplified surfaces,” Comput. Graphics Forum,Average connectivity attacks 0.27 0.12 0.21 0.16 vol. 17, no. 2, pp. 167-174, 1998.Average all attacks 0.22 0.08 0.17 0.19 [7] G. Lavoue,´ E. D. Gelasca, F. Dupont, A. Baskurt, and T. Ebrahimi, “Perceptually driven 3D distance metrics with application to watermarking,” in Proc. of the SPIE Electronicdifferent types of attacks. All the results are averages of Imaging, 2006, vol. 6312, pp. 63120L.1-63120L.12.5 trials with randomly selected watermark sequences and [8] Z. Wang, A. Bovik, H. Sheikh, and E. Simoncelli, “Imagekeys. We can conclude that in general the method of Wang quality assessment: From error visibility to structural simi- et al. is more suitable to be used in applications that larity,” IEEE Trans. on Image Process., vol. 13, no. 4, pp. require a high visual quality of the watermarked object, 1-14, 2004. while the method of Cho et al. is more appropriate for the [9] C. Zhang and T. Chen, “Efficient feature extraction for applications which have strict restriction on the amount 2D/3D objects in mesh representation,” in Proc. of the IEEE Int. Conf. on Image Process., 2001, pp. 935-938.of induced geometric distortion. However, in both kinds [10] K. Wang, G. Lavoue,´ F. Denis, and A. Baskurt, “Robust andof applications, if a strong robustness against connectivity blind watermarking of polygonal meshes based on volume attacks is required, then the method of Wang et al. seems moments,” Tech. Rep., LIRIS Laboratory, 2009, available at the better choice. http://liris.cnrs.fr/Documents/Liris-3713.pdf. [11] G. Taubin, “Geometric signal processing on polygonal VII. CONCLUSION meshes,” in Proc. of the Eurographics State-of-the-art Re- ports, 2000, pp. 81-96. We proposed a benchmark for the evaluation of robust [12] P. Lindstrom and G. Turk, “Fast and memory efficient mesh watermarking schemes. A software tool, which in- polygonal simplification,” in Proc. of the IEEE Visualization, cludes both geometric and perceptual distortion metrics, as 1998, pp 279-286. well as a large number of attacks, has been implemented. [13] D. Zorin and P. Schroder¨ , “Subdivision for modeling and Two different application-oriented mesh watermarking animation,” in Proc. of the ACM Siggraph Course Notes, 2000.evaluation protocols have been established. Two recent [14] J. W. Cho, R. Prost, and H. Y. Jung, “An obliviousrobust algorithms were compared within the proposed watermarking for 3D polygonal meshes using distribution benchmarking framework. The data set, the protocol con- of vertex norms”, IEEE Trans. on Signal Process., vol. 55, figuration file and the source code of the software are pub- no. 1, pp. 142-155, 2007. licly available at http://liris.cnrs.fr/meshbenchmark/. We 235