Attack modelling: towards a second generation watermarking benchmark

Digital image watermarking techniques for copyright protection have become increasingly robust. The best algorithms perform well against the now standard benchmark tests included in the Stirmark package. However the stirmark tests are limited since in general they do not properly model the watermarking process and consequently are limited in their potential to removing the best watermarks. Here we propose a stochastic formulation of watermarking attacks using an estimation-based concept. The proposed attacks consist of two main stages: (a) watermark or cover data estimation; (b) modification of stego data aiming at disrupting the watermark detection and of resolving copyrights, taking into account the statistics of the embedded watermark and exploiting features of the human visual system. In the second part of the paper we propose a “second generation benchmark”. We follow the model of the Stirmark benchmark and propose the 6 following categories of tests: denoising attacks and wavelet compression, watermark copy attack, synchronization removal, denoising/compression followed by perceptual remodulation, denoising and random bending. Our results indicate that even though some algorithms perform well against the Stirmark benchmark, almost all algorithms perform poorly against our benchmark. This indicates that much work remains to be done before claims about “robust” watermarks can be made. We also propose a new method of evaluating image quality based on the Watson metric which overcomes the limitations of the PSNR.