Robust Watermarking and Affine Registration of 3D Meshes

Citation preview

Robust Watermarking and Affine Registration of 3D Meshes Oliver Benedens Department Security Technology for Graphics and Communication Systems Fraunhofer IGD, Darmstadt, Germany

Abstract. We propose a robust non-blind watermarking algorithm based on direct free form deformations and applicable to smooth (organic) meshes. The algorithm does generate “low frequent” smooth deformations. The second main contribution of this paper is a registration method capable of handling affine transformations in cases where meshes do not suffer from cropping. The method is an extension of results from Blake and Marinos [1] to the 3D dimensional case. We use this method as a preprocessing step of a conventional registration algorithm (capable of handling rigid transformations plus uniform scaling). We are therefore able to automatically retrieve watermarks from copies differing from the original by one global affine transformation and of course additional complex operations, the watermarking method is robust against, such as polygon simplification, subdivision surfaces, uniform- or gaussian distributed noise. We present experiments on robustness of watermarks and performance of the proposed registration technique.

1

Introduction

In general currently proposed 3D watermarking algorithms target for two groups of applications: • •

Labelling, authentication and integrity-checks [15, 17, 18] Fingerprinting, copyright-protection (being able to prove copyright ownership or to be creator of 3D content) [4, 5, 6]

In this paper we propose a non-blind robust watermarking algorithm targeting for the second group of applications. It follows the general framework outlined by [4] for embedding a watermark of the 1-bit type. The algorithm basically applies free form deformations of “low frequency”. One of the main considerations in development was to realize a watermark detector with minimal underlying assumptions. The algorithm utilizes binary features for which we tried to achieve a good weighting between number of features, feature falsification probability and “unsuspicious” deformations. In benchmarking experiments performed we were interested in how the algorithm performs for relatively large embedding strengths and attacks. F.A.P. Petitcolas (Ed.): IH 2002, LNCS 2578, pp. 177-195, 2003.  Springer-Verlag Berlin Heidelberg 2003

178

Oliver Benedens

Since there is, for now, no preselection of regions suitable for embedding (e.g. nonplanar, no symmetries, high frequency components), application of the watermarking algorithm is currently restricted to entirely smooth or “organic” meshes. The second main contribution of this paper is concerned with the problem of affine transformations: Several watermarking algorithms have been proposed realizing robustness with respect to one global affine transformation [16] or even several local affine transformations [15, 17, 18]. All these algorithms share the limitation of not tolerating retesselations. Watermarking algorithms surviving retesselations such as [4, 5, 6] do not provide “inherent” robustness to affine transformations. In general these algorithms rely on external preprocessing steps, called mesh registration, for matching a watermarked copy to a original with respect to rigid transformations and uniform scaling . So far, affine transformation are not handled in this process. In this paper we propose a pre-mesh-registration technique preceding a conventional rigid registration algorithm, e.g. [8, 9, 10], which is able to remove a global “unwanted” affine transformation from a watermarked attacked copy without user assistance. In figure 1we give a functional model of our proposed watermarking framework. Original, Key

Original, Copy

Embedding

Copy

Pre−Registration

Registration

Key

Detector

W embedded/ not embedded

Fig. 1. Functional model of embedding (upper diagram) and retrieval (lower diagram) of a robust 1-bit watermark in our proposed framework

In general we demand that original and watermarked copy are indistinguishable to the human eye and the visual quality of the original is preserved. For CAD-oriented data additional demands with respect to preservation of numerical quality arise: Modifications must be performed within certain tolerances in order to preserve the usability of the data set (e.g. in a CIM process). Following steps are required to search a copy for watermarks: Since in our to be described watermarking scheme as well as in [4, 5, 6] information is embedded as differences of copy and original, the copy must first be transformed such it is congruent to the original, a process we name registration. We split this registration process in two stages: In the first pre-registration named stage the copy is “roughly” reoriented with respect to the original. The resulting initial solution should enable a conventional mesh registration scheme in the subsequent stage to converge to the desired result. After the process of registration, the copy can be tested for the presence of watermarks. The function block named detector determines for a given key if the associated watermark is present in the 3D object and returns a binary decision value (“embedded”/”not embedded”). Internally the detector compares features derived

Robust Watermarking and Affine Registration of 3D Meshes

179

from the original “watermarked” with the key in question and copy and determines how likely it is to observe the number of matching features by chance. If the probability is less than or equals a certain threshold-value (actually a probability), the detector returns “embedded”. In section 2 we describe techniques for carrying out the process of pre-registration. Our most noticeable invention in this respect is a technique suitable to remove a global affine transformation that was applied to the watermarked copy. In section 3 we give experimental results on estimating the performance of our proposed affine registration technique. Section 4 presents a novel robust watermarking algorithm for smooth, or “organic”, meshes, e.g. characters in the animation field or anatomical models. This algorithm implements the function blocks “embedding” and “detector” of figure 1. In section 5 we benchmark the robustness of our proposed watermarking algorithm, pre-registration and registration techniques described in previous sections. We conclude with a summary in section 6.

2

Mesh-Pre-registration

In a non-blind watermarking scheme, the watermarked copy and original must be made congruent before retrieval of a watermark. We split this process in two stages: In the “pre-registration” we remove a global affine transformation applying to the copy without user assistance (e.g. interactively selecting of pass points). An affine registration for polygonal meshes without user interaction has not been published previously to our knowledge. [7] also documents a successful affine registration but for parametric objects and using partial derivatives of first and second order. Our to proposed technique utilizes reorientation based on central moments (Principal Component Analysis) as a building block. After the pre-registration stage a conventional registration follows in which the optimal rigid transformation (plus uniform scaling) is determined, which minimises a certain distance metric between the original and the watermarked copy. We use the method proposed in [5], which minimizes the sum of squared distances of vertices in the watermarked copy to their respective nearest vertex in the original. In the following, denote the original with

Mˆ , the to be registered copy with Mˆ ′

ˆ ′′ . and the pre-registered result with M 3 An affine map α in is represented by

α : (x y z )T → A ⋅ ( x y z ) T + c

(1)

with regular matrix A ∈ 3x3 (detA ≠ 0) and c ∈ 3. Denote the associated group of all invertible affine transformations of 3 as A(3). Denote the sub group of affine transformations “consisting” of Euclidean motion in 3 as E(3). Denote the subgroup of invertible linear transformations as GL(3). Denote the set of triangular facetted meshes with non-zero volume as MT. A triangular facetted mesh is defined as a tuple (V,C), where V denotes the vertices and C denotes the connectivity information. We denote application of affine map

180

Oliver Benedens

T(x)=Ax+b to vertices of mesh M1:=(V1,C1) ∈ MT, V1:=(v1,..,vn) as T o M 1 . The resulting mesh is represented by M2:=(V2,C1) with V2=(T(v1),.., T(vn)). Denote IA(3)(M) as the set of images of mesh M under affine mappings of group A(3). We now want to identify a particular image of IA(3)(M), denoted with I*A(3),M, maximizing a certain measure F (to be defined later). For now just assume a maximum with respect to F exists, is unique and we are able to define a optimization technique φ : MT → A(3) returning an affine map which transforms a given mesh M and all (invertible) affine transformed versions of it to I*A(3),M. The optimization technique φ then achieves invariance with respect to affine maps of group A(3) of the following form for a given M ∈ MT:

∀h ∈ A(3) : φ (h o M ) o ( h o M ) = φ ( M ) o M We denote

φ as

a an affine normalization technique,

normalizing transformation for M and

φ (M ) as

(2) the affine

φ ( M ) −1 as the inverse transformation.

ˆ and copy Mˆ ′ with arbitrary invertible affine Then, given original mesh M transformation applying on it, the process of pre-registration can be carried out through: Mˆ ′′ := φ ( Mˆ ) −1 o (φ ( Mˆ ′) o Mˆ ′)

(3)

For one particular realization of φ it will be shown in practical experiments of section 3, that even if connectivity altering operations such as polygon simplification were applied to the watermarked copy (in addition to an affine transformation), we achieve

I *A( 3),Mˆ ≈ I *A( 3), Mˆ ′ (small “distances” between these images (meshes); we

define a possible distance metric in section 3), because the to be defined F is invariant to the mentioned operation (up to a certain degree). In section 2.1 we will briefly recapitulate a method for reorienting a mesh based on Principal Component Analysis (PCA). In section 2.2 we will give one particular realization of φ utilizing this method as a building block. 2.1

Pre-registration Based on Principal Components Analysis (PCA)

In [3] a method is proposed, denoted as PCA with associated Karhunen-Loeve transform, which achieves invariance of a polygonal mesh with respect to affine maps of sub group E(3): All images of a mesh M with respect to E(3), denoted as IE(3)(M), are mapped to one particular representative (if constrains mentioned at the end of this section are fulfilled), denoted with I*E(3),M. The method utilizes PCA analysis and since this topic is a well known and extensively published technique, we describe only our changes made to their algorithm: After moving the (weighted) centre of mass of M into the origin and applying a rotation (columns of rotation matrix are eigenvectors of covariance matrix calculated from vertices of M), we achieve

Robust Watermarking and Affine Registration of 3D Meshes

181

reflection invariance through multiplication with following diagonal matrix F (vik are the vertex coordinates of M, k ∈ { x, y , z} , 1 ≤ i ≤ n ):

F := diag ( sign( f x ), sign( f y ), sign( f z )) , f k := max(vik ) + min (vik ) i =1,..,n

i =1,..,n

This simple variant proved to be more robust in tests in cases with respect to polygon simplification. In cases where no robust order of eigenvalues can be determined or no robust direction of an eigenvectors can be derived from the according eigenvalue, up to 7 additional symmetry cases have to be considered in the following conventional mesh registration processing step. Recently Ohbuchi et al. [6] utilized a method similar to [3] for coarse mesh alignment (reorientation). In the following, denote the registration technique described as η : MT → E(3). η (M) yields the affine map transforming mesh M to I*E(3),M. 2.2

An Affine Normalization Technique

Next we define a realization for φ based a measure informally denoted as “Maximum Compactness”. An analogue isoperimetric measure has been applied to the 2D case in [1, 2]. Remark: If we would set φ := η , then pre-registration as stated in (3) would show robustness with respect to low pass filtering (e.g. Taubin-smoothing) or polygon simplification but cannot cope with arbitrary invertible affine transformations. Maximum Compactness For a given Mesh M ∈ MT, we search for a linear transformation L ∈ GL(3), maximizing the following measure, informally denoted with compactness:

F := vol area

(4)

vol is the volume and area the surface of mesh L o M (we keep area=1 constant). We determine the linear transformation maximising (4) using Powell’s direction set method [11] (9 parameters, we assume center of mass m of mesh has been moved into origin prior to starting maximization). F is scale-dependent and we keep the surface constant as follows (in cost-function): 1. 2.

Calculate area. Apply uniform scaling with factor 1 / area to mesh. Calculate vol by summing volumes of all tetrahedrons consisting of triangular surface patches and the centre of mass. Set F:=vol.

F is invariant with respect to affine maps of sub group E(3), therefore we have to apply η to the determined L o M to achieve a unique solution (assuming η yields a unique solution). Finally we define

φ ( M ) := η ( L o M ) ⋅ L

(5)

Since F is upper bounded (a sphere is the solution to the isoperimetric problem in 3D and maximizes volume with respect to surface), a maximum exists. Empirical test

182

Oliver Benedens

results support the assumption of uniqueness of this maximum in practice and a possible theoretical proof is classified as future work. We note that convergence of our proposed optimisation technique to this maximum cannot be proven, because applying the direction set method does not guarantee finding a global maximum. If connectivity of a watermarked mesh is modified through e.g. polygon simplification, then we reason, that measure F (defined by mesh surface and volume) is robust with

ˆ ) ≈ φ ( Mˆ ′) . We demonstrated respect to this modification and we expect φ ( M applicability of our proposed technique through experiments documented in section 3. Appendix A.1 gives a “visual” example.

3

Performance of the Proposed Affine Normalization Technique

For watermarking applications, we cannot expect original and watermarked mesh to differ just by one affine transformation. Everyday-processing of meshes involves a large variety of geometry and topology altering operations, e.g. polygon simplification or mesh smoothing. We are therefore interested in measuring, how our normalization performs in removing affine transformations in presence of other, more complex operations. The example illustrated in A.1 is such a test case. Next we define two distance metrics hmean and hmax. Let d(v,M) denote the minimum distance of vertex v to surfaces in mesh M. Given two meshes M1 and M2 with V={v1,..,vn} being the vertex set associated with mesh M2, we define the metrics as

hmean ( M 1 , M 2 ) :=

1 n ∑ d (vi , M 1 ) hmax ( M 1 , M 2 ) := max i=1,..,n d (vi , M 1 ) n i =1

Denote the original mesh with M, a (complex) mesh altering operation with O. O(M) denotes the resulting mesh after applying O. We define O'(M):=A2 o O(A1 o M), with A1 and A2 being invertible (''non-degenerating'') affine transformations. As defined in the previous section let φ (M) denote the affine normalizing transformation matrix (technique utilizes the maximum compactness measure) for mesh M, let φ (M)-1 be the inverse transformation. For estimating the performance of our normalization technique with respect to the application of mesh registration, we compare m1,type:=htype(M,O(M)) with m2,type:=htype(M, φ (M)-1 o ( φ (O’(M)) o O’(M)) and m3,type:=htype(O(M),M) with m4,type:=htype( φ (M)-1 o ( φ (O’(M)) o O’(M),M) for all relevant operations O and type ∈ {mean,max}. One may argue why we do not compare O(M) and φ (M)-1 o ( φ (O’(M)) o O’(M)): This is because in non-blind watermarking applications original and watermarked copy are compared in the retrieval process. For the case of blind watermarking applications, watermarks would have to be embedded in affine normalized meshes and we would compare φ (M) o M with φ (O’(M) ) o O’(M). Application of our proposed technique to blind watermarking algorithms is subject to future research. We assume O not to be an affine transformation by itself, otherwise these would get removed in the process of normalization. Of course if

Robust Watermarking and Affine Registration of 3D Meshes

183

A1 ≠ I (I =identity matrix), O(A1 o M) may differ largely from O(M) because operation O may not be affine invariant (e.g. polygon simplification). In such a case it is “unfair” to compare the measures mentioned, however since in reality an affine transformation may occur at every stage of the mesh processing pipeline, we are nevertheless interested, how successfully the normalizing technique is in removing A1 as well as A2. In the following experiments we set either A1 or A2 to I. Regarding the application of mesh registration we could certainly improve the results with respect to m2,mean and m4,mean in the following way: Denote R(X,Y) a conventional mesh registration algorithm registering mesh Y with respect to original X. Instead of φ (O'(M)) we would use R( φ (M) o M, φ (O'(M)) o O'(M)) in calculation of m2,type and m4,type (type ∈ {mean,max}). We used two meshes in experiments, a crater lake mesh (5135 vertices, 9822 faces) and a deer mesh (5392 vertices, 10654 faces). To achieve scale independence in calculation of measures mi,type every distance d(v,M) is scaled by 1/bb(M) with bb(M) being the bounding box diameter of mesh M. We applied three operations: smooth denotes application of 1 iteration of Taubin-smoothing, subdiv denotes polygon simplification downto 500 faces and applying 1 iteration of Loop-subdivision and noise denotes applying white noise of strength 1% of bounding box diameter to each vertex coordinate. For simplification we used the QSlim-implementation of Garland [14] with optimal placement of collapsed points. Table 1 lists the results: In each field, the first line gives the result for the case A1=I, while the second line gives the result for A2=I. For the deer test case m1,mean and m2,mean values (differences to original mesh) are of roughly the same size. In the crater case, especially the case A1 ≠ I, A2=I causes large deviations. This has several reasons: The crater mesh is flat, not spherical, therefore volume calculation in the normalization process is “less stable” and polygon simplification leads to largely differing volumes. Second, the noise factor of 1% causes large changes due to the large ratio of bounding box diameter and shortest edge of bounding box. We want to note that smoothing is affine invariant because updated vertex positions are linear combinations of original vertices. As can be observed for the deer mesh, measures in the smooth test case are equal, in case of the crater mesh, we suffer from inaccuracies in the normalization process. In figure 2 we investigated accuracy of our technique with respect to Qslim polygon simplification. dist 0.01

dist 0.01

0.009

0.009

m 1,mean m 2,mean m 3,mean m 4,mean

0.008 0.007 0.006

0.007 0.006

0.005

0.005

0.004

0.004

0.003

0.003

0.002

0.002

0.001 0

m 1,mean m 2,mean m 3,mean m 4,mean

0.008

0.001

250

500

750

1000

1250 1500 1750 2000 Number of faces

2250

2500

2750

3000

0

250

500

750

1000

1250 1500 1750 2000 Number of faces

2250

2500

2750

3000

Fig. 2. Mean distances for O chosen as simplification downto number of faces given on x-axis (left image deer mesh, right image crater mesh). A1 was set to I, A2 was translation, rotation and shearing (applied in this order). All distances with respect to original whose bounding box diameter was scaled to 1

184

Oliver Benedens

Table 1. Experiments on evaluation performance of affine normalization transformation “in presence” of other (complex) operations, such as Taubin-smoothing, polygon simplification & subdivision surfaces and white noise. The crater mesh proved to be the worst case for our proposed normalization algorithm. All values in table are absolute distances with respect to the original, whose bounding box diameter was scaled to 1 Attack m1,max (m1,mean) Mesh: deer Smooth 9.97e-04 (8.72e-05) “ Subdiv 0.011595 (0.003142) “ Noise 0.016674 (0.004402) “ Mesh: crater Smooth 0.003322 (2.39e-04) “ Subdiv 0.010123 (8.76e-04) “ Noise 0.015284 (0.004796) “

4

m2,max (m2,mean)

m3,max (m3,mean)

m4,max (m4,mean)

9.74e-04 (2.14e-04) 9.74e-04 (2.14e-04) 0.023942 (0.006965) 0.024245 (0.006758) 0.015116 (0.003609) 0.052361 (0.011392)

0.001224 (1.03e-04) “ 0.022442 (0.005866) “ 0.012578 (0.003356) “

0.001169 (2.17e-04) 0.001169 (2.17e-04) 0.037206 (0.008522) 0.041913 (0.008827) 0.013784 (0.002754) 0.053942 (0.010684)

0.015326 (0.002160) 0.015392 (0.002167) 0.021196 (0.003756) 0.046857 (0.012062) 0.039305 (0.004415) 0.062883 (0.006920)

0.01357 (3.92e-04) “ 0.029333 (0.001500) “ 0.010887 (0.003472) “

0.019261 (0.002326) 0.019361 (0.002338) 0.069650 (0.005972) 0.072048 (0.014509) 0.017925 (0.003670) 0.062534 (0.006649)

A Novel Robust Watermarking Algorithm for Organic Meshes

We developed a new watermarking technique targeting the applications fingerprinting and copyright-protection. Before presenting the details we shortly give a general view of the algorithm: The algorithm modifies meshes through the application of direct free form deformations [12]. First of all so called feature points are selected on the mesh surface. The selection process is key-dependent. In the embedding process, feature points are moved, depending on a key, in their respective normal or reverse-normal direction by applying direct free form deformations. 4.1

Essential Requirements for a Watermarking Scheme

We already mentioned requirements on a 3D watermarking scheme with respect to preservation of visual and numerical quality. In addition there are other simple information-theoretic based requirements whose non-fulfilment causes a watermarking scheme to be non-applicable to the applications fingerprinting and proof of copyright. Among those requirements are: • •

The watermarking scheme must realise “sufficiently” low false positive fp and false negative fn probabilities. All information-theoretic assumptions underlying the watermark detector must still hold for attacked watermark copies (for all attacks the watermark is intended to survive). Otherwise the certainty associated with a decision of the detector is lowered.

Robust Watermarking and Affine Registration of 3D Meshes

4.2

185

Selection of Features

We try to achieve a maximum of non-interfering features by distributing them on a mesh while maximising the minimum (Euclidean) distance of a feature point to it’s nearest neighbour. We developed a simple greedy algorithm for this purpose given in pseudocode in figure 3: V1,..,Vn denote the mesh vertices (n is number of vertices), ε denotes the desired inter-feature-point distance, nf denotes the number of feature points to select, nfs is the number of feature points selected and K is the secret key influencing the feature point selection process (seeds random number generator). Initially the set A is assigned the vertices of the mesh. The algorithm selects N vertices from this set as feature points. The final result, vertices selected as feature points, is stored in set C. Figure 3 shows selected features using this technique. In the actual implementation there are two more options for selection of features: Vertices above or below a specified plane are excluded from the set of feature point candidates. With this option, the “standing surface” of 3D objects can be fixed. For objects with one (main-) symmetry axis features can be chosen symmetrically which means the symmetry is preserved in embedding as visualised in figure 3. Please note: Regarding the properties of the to be described detector, symmetrically choosing feature points is equally to halving number of features ! Our selection of features is key dependent to guard against coalition attacks in which several watermarked copies are averaged (although we did not implement this attack by now).

A := {V1 ,..,Vn }, B := {} seed ( K ); nf := N ; nfs := 0; ε = const while nfs < nf and A ≠ {} v := random element of A J := {all vertices in A with distance ≤ ε to v} A := A \ J ; B := B ∪ J ; C := C ∪ v nfs := nfs + 1 while nfs < nf and nfs < n select v ∈ B with maximum distance to nearest... ... vertex in C B := B \ {v}; C := C ∪ {v} nfs := nfs + 1 Fig. 3. In this example 120 feature points haven been chosen symmetrically (upper left image shows original). As can be seen from the lower left image, deformations applied in the embedding process (described in section 4.3) preserve symmetry (left deer is original, right is watermarked copy). Embedding strength applied in example was 0.8% of bounding box diameter (max. length of a feature point displacement vector, see next section). Right: Pseudocode for selection of feature points (see text)

186

Oliver Benedens

4.3

The Sculpting-Process

We briefly describe the deformation techniques utilised in the embedding process: A free form deformation (FFD) [12] modifies an object by deforming the space the object is embedded in. A FFD involves the following steps: At first the positions of vertices of an object in local frames spanned by control points are determined. Next the control points are displaced. Finally updated global vertex coordinates are calculated from local coordinates and modified control points. In the following we apply the notation used in [12]. We assume the volume of a 3D object is enclosed by a 3D grid of control points defined by orthogonal vectors s,t,u. Each object vertex V is assigned local coordinates s,t,u which depend on control points Pi , j , k : 0

V = qi , j ,k ( s, t , u ) = ∑l ,m ,n = −3 Pi +l , j + m,k + n Bl ( s ) Bm (t ) Bn (u ) Pi , j , k is the i-th,j-th,k.-th control point in s-,t-,u- direction. The Bs are so called basisfunctions (or blending functions). If Bernstein polynomials are chosen as basis, we achieve global deformations (global control in editing processes), if we choose a Bspline-basis we achieve local deformations (local control). In the latter case q is called a trivariate B-spline-tensor-product and for calculating the local coordinates the Bspline-map must be inverted which is accomplished through root-finding-techniques. [12] describes a technique for direct manipulation through free form deformations. To realise a displacement of an object-point, displacements in control points are determined such that the sum of squares of displacement-vectors of control points is minimal. Denote the displacement of an object point q with ∆q , the rows of nx3 matrix

∆P contain the control point displacements ∆Pi . With regard to q, each control

wi , which is the product of the three blending functions evaluated at local coordinates of q. Set B = ( w1 ,.., wn ) . We now search for a

point is assigned a weight

∆P * minimising B∆P * − ∆q , whereby P * is small as possible. As described in *

[12], for a single row matrix B, P is calculated as follows:

B+ =

1 B

2

BT (6)

∆P * = B + ∆q For our application we need to move several object points (more precisely feature points) qi “simultaneously”. We accomplish this in the following way: A control point P influences object points displacements

q1 ,.., q n for which we calculated

∆P1 ,.., ∆Pn for P. wi denotes the product of the three blending

Robust Watermarking and Affine Registration of 3D Meshes

functions of P for q i . The optimal displacement vector chosen such that the error

187

d * for control point P is

n

e(d * ) = ∑i =1 ( wi d * − wi ∆Pi ) 2 is minimal and is calculated as

d

*

n 2 i i =1 i n 2 i =1 i

∑ w ∆P = ∑ w

(7)

The method described has been applied in [13] for scattered data interpolation. Our watermarking scheme applies the described deformation technique for displacing feature points in normal- or reverse-normal direction, dependent on a key. Normals are derived from local surface normals at feature point positions. One drawback of the deformation method is the difficulty to fulfil restrictions regarding maximum tolerated object vertex displacements. In the actual implementation we applied following simple strategy: We choose a global maximum θ for maximum tolerated object point displacements and apply a re-scaling of control point displacement vectors using factor

α = min{max{1,θ / pi '− pi }} . 1≤i ≤ N

p1 ,.., p N and p1 ' ,.., p N ' are the object vertices prior and after applying the deformation. Another drawback stems from the simple fact that the deformation technique yields only an approximation of desired changes, which means the desired new feature points are not interpolated in general. This constitutes a problem in practice if a (too) large number of feature points has been selected. In the actual implementation we used B-spline blending functions, 120 feature points and we set θ :=e by default. Increasing the number of control points is not a good idea in general since deformations become too “high-frequent”. Optional Bezier-blending-functions can be used instead of B-spline ones. This results in visually more “inconspicuous” deformations, however the variational-degree is less and therefore a less number of features can be embedded and the achieved embedding strength is effectively lowered (each control point is influenced by all feature points). 4.4

Detector

Next we will point out the minimal assumptions are underlying our detector: A key generates n randomly distributed “feature-bits” b1,..,bn. Given are n feature points F1,..,Fn with associated normals N1,..,Nn together constituting planes E1,..,En. After registration of copy and original we determine the nearest intersection points for rays starting in feature points and continuing in normal- and reverse-normal direction. Denote the distances of intersection points to E1,..,En with d1,..,dn. If bi=0 the deformation in the embedding process had been applied in direction Ni, else in direction - Ni.

188

Oliver Benedens

To test a key , we determine the number of matching observations (bi=0, di>0) and (bi=1, di0.5 were set to 0 in the diagram (value for correct key was 4.4e-16)

Robust Watermarking and Affine Registration of 3D Meshes

191

Please note that we used all available information in the retrieval process: If a binary feature value could not be embedded (recall the embedding process does only approximate the desired deformations), it is not considered in the retrieval process. Additionally we do not consider features, whose associated intersection point exceeds a certain distance (we used 0.1% of bounding box diameter). For meshes of the “organic”-type, the embedded watermarks are usually non-perceivable to the human eye (depends of course on embedding strength). For a subset of attacks, QSlim-based polygon simplification and uniform noise, we determined the respective Receiver Operator Characteristic (ROC). All according results are stated in the figures 7-9 in appendix A.2. Empirical determined ROCs for various simplficiation rates (1500, 1000, 500 faces) and uniform noise strengths (0.7%, 0.5%, 0.3%) are given in figure 8. We applied the methodology given in [4] for generating ROCs: In each of 200 test cases, we watermarked the bunny mesh with a different key, applied an attack (e.g. random noise of fixed max. strength), applied simulated per hand orientation (for sake of registration speed), applied the conventional mesh registration algorithm proposed in [5] and determine the detection value for the correct key. As proposed in [4] we determine the false negative probability for given false positive fp of a test case as the fraction of 200 tests yielding detection values (probabilities) larger than fp. In order to collect evidence for fulfilment of assumptions underlying the detector, we additionally determine detection values of all other (wrong) 199 test keys for each test case. In the table given in figure 9 we list for each ROC the maximum detection value (probability) for the 200 correct keys and the minimum detection value for the 39800 wrong keys. The left image of figure 9 shows analytically and empirically determined frequency of number of matching features for wrong keys for the particular test case of QSlim-based simplification to 1000 faces. The analytical determined frequency is based on the assumption that that the number of matching features for the unwatermarked/wrong key case is B120;0.5 (binomial-) distributed. In left image of figure 7 we plot the analytically determined false positive probability for a fixed false negative probability, a fixed feature falsification probability of 0.1 and varying number of features. ffp denotes the probability that a binary feature of a watermarked mesh is falsified due to a not further specified attack. We assume independence of features. The image illustrates the relationship between number of realized features and detector performance. We reason that croppingattacks leaving only e.g. 60 of 120 features render a detector unusable if ffp is not far less than 0.1. Please note that the assumption of constant ffp for varying number features is only an approximating one, because the larger the number features, the smaller the embedding strength needs to be chosen in order to generate nonnoticeable deformations and the larger ffp. In the right image of figure 7 we plotted two analytically determined ROCs for the case of 120 features and ffp=0.1, 0.2. All plots in figure 7 are based on the previously stated assumption that the number of matching features for the unwatermarked/wrong key case is B120;0.5 distributed and the additional assumption that the number of falsified feature bits of a watermark in case of an attack is B120;ffp distributed.

192

Oliver Benedens

6

Summary and Outlook

We developed a novel robust watermarking technique applicable to smooth (organic) meshes and a registration scheme capable of handling affine transformations. For now, the registration technique is used in a non-blind scheme for realigning original and watermarked copy prior to watermark retrieval. The only benefit arising from this scheme for now is to be able to perform this process without user assistance. If user assistance is possible, alternatively passpoints in original and copy could be interactively selected and the optimal affine transformation in the least squares sense calculated (Pseudoinverse). In principle, the registration algorithm can be applied to blind schemes as follows: Prior to embedding and retrieval, a mesh is transformed into normalized state. After embedding the watermark, the inverse of the normalizing transformation is applied. Modifying a normalized mesh requires conversion of metrics and constrains associated with the embedding process, problems we have not addressed by now. We already mentioned the cropping problem, which may be overcome by deriving the normalizing transformation from only a subset of robust feature points.

Acknowledgements This work has been supported by BMBF grant “OpenSG PLUS”. Developments in context of this project are documented in [19]. The author thanks Nikolaus Schmitt for discussions and the anonymous reviewers for their valuable comments and suggestions.

References 1. 2.

3.

4. 5. 6.

7.

Blake and C. Marinos, "Shape from texture: Estimation, isotropy and moments", Artificial Intelligence, vol. 45, pp. 323-380, 1990. D. Sinclar and A. Blake. "Isoperimetric Normalization of Planar Curves", IEEE Transactions On Pattern Analysis and Machine Intelligence, 16(4), pp. 769-777, August 1994. Vranic, D. Saupe and J. Richter, "Tools for 3D-object retrieval: Karhunen-Loeve Transform and spherical harmonics", IEEE 2001 Workshop Multimedia Signal Processing, Cannes, France, Oct. 2001. Praun, H. Hoppe and A. Finkelstein, "Robust Mesh Watermarking", SIGGRAPH 99 Proceedings, pp. 69-76, 1999. K. Yin, Z. Pan, J. Shi and D. Zhang. "Robust mesh watermarking based on multiresolution processing", Computers & Graphics, vol. 25, pp. 409-420, 2001. R. Ohbuchi, A. Mukaiyama and S. Takahashi. "A Frequency-Domain Approach to Watermarking 3D Shapes”, EUROGRAPHICS 2002 Proceedings, Saarbrücken, September 2-6, 2002. J. Feldmar and N. Ayache, "Rigid, affine and locally affine registration of freeform surfaces", Int. J. of Comp. Vision, vol. 18, pp. 99-119, 1996.

Robust Watermarking and Affine Registration of 3D Meshes

8.

9. 10.

11. 12. 13. 14.

15.

16. 17.

18.

19.

193

P. Besl and N. McKay, "A Method for Registration of 3-D Shapes", IEEE Transactions on Pattern Analysis and Machine Intelligence, 14(2), pp. 239255,1992. Y. Chen and G. Medioni, "Object modelling by registration of multiple range images", Image and Vision Computing, 10(3), pp. 145-155, 1992. S. Umeyama, "Least Squares Estimation of Transformation Parameters Between Two Point Patterns", IEEE Transactions on pattern analysis and machine intelligence, 13(4), 376-380, 1991. W. Press et al., "Numerical Recipes in C - Second Edition", Cambridge University Press, 1992. W. Hsu, J. Hughes and H. Kaufman, "Direct Manipulation of Free-Form Deformations", SIGGRAPH'92 Proceedings, pp. 177-182, 1992. S. Lee, "Interactive multiresolution editing of arbitrary meshes," Computer Graphics Forum (Eurographics 99), vol. 18, no. 3, pp. 73-82, 1999. Garland, P. Heckbert. Surface Simplification Using Quadric Error Metrics. SIGGRAPH 97 Proceedings, 1997. QSlim simplfication package available from http://graphics.cs.uiuc.edu/~garland/software.html. R. Ohbuchi, H. Masuda, and M. Aono. Watermarking Three-Dimensional Polygonal Models. Proceedings of the ACM International Conference on Multimedia ’97, pp. 261-272, 1997 M. Wagner. Robust Watermarking of Polygonal Meshes. Proc. Geometric Modeling & Processing 2000, pp. 201-208, Hong Kong, April 10-12, 2000. X. Mao, M. Shiba and A. Imamiya. Watermarking 3D Geometric Models Through Triangle Subdivision. Proceedings of SPIE Vol. 4314, Security and Watermarking of Multimedia Contents III, pp. 253-260, San-Jose, January, 2001. Ohbuchi, H. Masuda and M. Aono. A Shape-Preserving Data Embedding Algorithm for NURBS Curves and Surfaces. Proceedings of the Computer Graphics International (CGI) 1999, Canmore, Canada, June, 1999. O. Benedens, "3D Watermarking Algorithms in Context of OpenSG Plus", Technical Report 02i002-figd, 2002. Download through http://publica.fhg.de/.

Appendix A.1.

Affine Registration Example

Figure 6 gives an example for application of the pre-registration technique proposed in section 2. The positive result of this test case stems from the fact, that the attacks did not cause significant cropping effects. We want to stress that our proposed affine registration technique is sensitive to cropping.

194

Oliver Benedens

Fig. 6. First row, from left to right: Original deer mesh. mesh in state of maximum compactness, mesh after reorientation (incl. handling reflections) based on principal components and original mesh from different viewpoint. Then we applied QSlim-simlification from 10654 down to 500 faces, translation, rotation and shearing. Second row: Mesh after applying mentioned attacks, mesh in state of maximum compactness, mesh after reorientation based on principal components and attacked mesh after applying pre-registration using equation (3) defined in section 2 (same viewpoint as in first row)

A.2.

Analytically and Empirically determined Receiver Operator Characteristics (ROCs)

f

f p −30

n

1 ffp=0.1 ffp=0.2

0.9

(log10) −25

0.8 0.7

−20 0.6 −15

f n = 0.25 f n = 0.5

0.5 0.4

−10

f n = 0.1 f n = 0.01

0.3 0.2

−5 0.1 0 20

40

60

80

100

120 140 160 Number of features

180

200

220

240

260

0 −30 −28 −26 −24 −22 −20 −18 −16 −14 −12 −10 f p (log10)

−8

−6

−4

−2

0

Fig. 7. Left image shows analytically determined (achievable) false positive probability for four fixed false negative probabilities and varying number of features. We assume each feature is independently falsified with probability 0.1 (ffp-feature falsification probability). Right image: ROC of the proposed detector with analytically determined false positive and false negative probabilities. Left curve shows ROC for ffp=0.1, right curve for ffp=0.2

Robust Watermarking and Affine Registration of 3D Meshes

f

fn

1

n

1500 1000 500

0.9 0.8

195

1 0.9 0.3% 0.5% 0.7%

0.8

0.7

0.7

0.6

0.6

0.5

0.5

0.4

0.4

0.3

0.3

0.2

0.2 0.1

0.1 0 −30 −28 −26 −24 −22 −20 −18 −16 −14 −12 −10 f p (log10)

−8

−6

−4

−2

0

0 −30 −28 −26 −24 −22 −20 −18 −16 −14 −12 −10 f p (log10)

−8

−6

−4

−2

0

Fig. 8. Empirically determined ROCs for QSlim based polygon-simplification (left image, simplifications downto 1500,1000,500 faces) and uniform noise (right image, noise strength 0.3,0.5,0.7% of object bounding-box diameter per coordinate) freq 0.08

Attack

0.07 empirical analytic

0.06 0.05 0.04 0.03 0.02 0.01 0

0

10

20

30

40 50 60 70 80 Number of matching features

90

100

110

120

S 500f S 1000f S 1500f N 0.7% N 0.5% N 0.3%

Dmax,c (#features) 1.4e-03 (75) 2.9e-09 (91) 2.8e-11 (94) 1.6e-05 (83) 1.1e-11 (96) 7.3e-18 (104)

Dmin,f (#features) 6.9e-05 (80) 9.8e-06 (83) 1.9e-06 (83) 9.8e-06 (83) 7.9e-05 (81) 1.6e-05 (83)

Fig. 9. Testing false keys in test case of ROC given in fig. 8 (simplification to 1000 faces). A total of 39800 “wrong” keys were tested (199 keys on each of 200 watermarked copies) and the distribution of matching features plotted in the left image. Cross shaped dots show analytically determined distribution if all assumptions underlying the detector are fulfilled. The maximum number of matching features for a wrong key was 83 resulting in a detection value of 9.80592e06. The empirical curve is shifted slightly to the left with respect to the analytical one because of non-interpretable features in retrieval (e.g. no intersection for feature point in normal direction due to embedding/attacks). The table on the right list for each test case (Ssimplification, N-noise) Dmax,c the maximum detection value (probability) for correct keys and the minimum detection value (probability) for wrong keys., Dmin,f, together with according number of matching features