Blind Pattern Matching Attack on Watermark

SystemsD. Kirovski and F. A. P. Petitcolas

IEEE Transactions on Signal Processing, VOL. 51, NO. 4, April 2003

Outline

• Introduction• The blind pattern matching attack

(BPM)– Notations– Attacking steps– Attacking parameter determination

• BPM attacks for spread-spectrum watermarking and quantization watermarking of audio signals

• Conclusions

To Attack Digital Watermarking

• Main types of attacks– To remove the watermark

• Estimating the unmarked cover signal– Median filters

• Collusion attacks for fingerprinting

– To prevent the detector from detecting the watermark• Geometric distortions

The BPM Attack

• An attack aims to reduce the correlation of a watermarked signal with its watermark by replacing blocks of samples of the marked signal with perceptually similar blocks that are either not marked or marked with a different watermark

Attacking Strategy

1. Partition the content into overlapping low-granularity signal blocks

2. Identify subsets of perceptually similar blocks

3. Randomly permute their locations in the signal

Search Space

• If the number of blocks that have perceptually similar counterparts within the media clip is small, the adversary can seek replacement blocks in an external multimedia library

• Even without external replacement, watermark detector faces a task of exponential complexity to reverse the permutation

Block Sizes

• The adversary needs to reduce the granularity of integral blocks of data such that no block contains enough information from which a watermark can be identified individually– Blocks considered for BPM must at

least one order of magnitude smaller than watermark length• Audio: 128-1024 coefficients• Video: 64x64 pixels

Notations

• Host signal

• Watermark

• Marked signal

),0(~, xiN NxRx

The BPM attack is not limited to certain signal model. The Gaussian assumption facilitates further analysis.

xNRw ,

e.g. in spread-spectrum watermarking,

Nw }{

wxx ~

Attacking Concerns

• Signal partitioning• Similarity function

– Determining the lower bound of similarity

• Pattern matching• Block substitution

Signal Partitioning

• The watermarked signal is partitioned into n overlapping blocks.

• Each block Bp represents a sequence of m samples starting at

• Why overlapping?– Consecutive blocks may lack

perceptually similar characteristics

)],1/()[( mNn :the overlap ratio

)(~ pBx

Similarity Function

• The quadratic Euclidean distance between blocks are used:

1

0

2)(~)(~ ][),(

m

iBxiBxiqP qp

yyBB

Pattern Matching

• Perceptual similarities between individual blocks are identified by a symmetric similarity bit-matrix S:

• The upper bound preserves fidelity, the lower bound is required since a block of exceptional similarity will not affect watermark detection

,0

,1,qpS

if22 ),( mBBm qp

otherwise

22 , :parameters that denote the minimal and maximal average similarity

Determining the Lower Bound

(1/2) • In the SS watermark detector

– The watermark w is detected in the signal z by matched filtering

• If z has been marked with w

• Otherwise

• Detection threshold

wzwzC T),(

2),( mwzC

0),( wzC

2/2 m

Determining the Lower Bound

(2/2) • Now assume the vector x+w is

similar to and replaced by y+v

2222

2222

222

222

)),(22))((

))())((

)()(

)()(

mwvCEmxyEm

mwvExyEm

mwvxym

mwxvym

0)2

()(2

1

),(

),(

222

mxyE

wvCE

wvyCE

2

if

Block Substitution

1. Copy2. Marked all blocks as unvisited3. Find unvisited Block Bp

4. Let Gp be a set of indices, s.t.

5. Let Lp be a random permutation of elements of Gp

6. Reorder blocks of with Gp according to Lp

7. Marks all blocks in Gp as visited

8. Go to Step 3.

xx ~'~

1, , qpp SGq

'~x

Experimental Results

• Test BPM attacks for audio contents watermarked with spread-spectrum and quantization index modulation schemes– For the SS scheme, within a 30s audio

clip, the attack creates approximate 4 to 5 dB noise and brings the SS correlation detector to half the expected value without attack

– Similar adversary effects can be obtained for the QIM detector

Remedies against the BPM Attack

• Identifying rare parts of the content and marked these parts only– Reducing the practical capacity and

increasing the embedding complexity

• Longer watermarks and increased detector sensitivity– Very-long watermark sequence and

lower robustness against other attacks