A Benchmark for 3D Mesh Watermarking

distortion metrics, attacks and evaluation methodologies and its watermarked version. The robustness indicates how when reporting their experimental results. Therefore, it is resistant the watermark is against various routine opera- necessary to propose a benchmarking system to the mesh tions on the wed content. A secure watermarking watermarking community, with the objective to attain a scheme should be able to withstand the malicious attacks fair and easy comparison between different algorithms. that aim to break down the whole watermarking-based Several benchmarking systems have been constructed copyright protection system through, for instance, secret for evaluating image watermarks, such as Stirmark [2], key disclosure or inversion of the watermark embedding Checkmark [3] and Optimark [4]. In contrast, to the best procedure. In the proposed benchmark, we consider only of our knowledge, the benchmarking of 3D mesh water- the payload, distortion and robustness evaluations, while marks was addressed only by Bennour and Dugelay [5]. 1They propose to use some existing software packages to Available at http://liris.cnrs.fr/meshbenchmark/ 978-0-7695-4072-6/10 $26.00 © 2010 IEEE 231 DOI 10.1109/SMI.2010.336 0discarding the security metric. The main reason is that local windows p and q (respectively inM andM ) is the research on mesh watermarking is still in its early defined as follows: stage [1] and until now the community has been interested 13 3 3 3d (p;q) = (0:4 L(p;q) +0:4 C(p;q) +0:2 S(p;q) ) ;LMSDM in achieving robustness against connectivity attacks (e.g. (3) surface simplification and remeshing) while paying little where L, C and S represent respectively curvature, con- attention on security, a rather high-level requirement. trast and structure comparison functions (please refer to [7] Finally, when reporting the evaluation results, the authors for more details). The global MSDM distance between two 0should also indicate whether their scheme is blind, semi- meshesM andM (both havingn vertices), is defined by blind or non-blind. a Minkowski sum of the meshes’n local MSDM distances When evaluating a robust mesh watermarking scheme measured on their n vertices: !1by using the above metrics, we also need a well-defined n 3X0 1 3protocol which indicates the steps to follow when conduct- d (M;M ) = d (p ;q ) 2 [0;1): (4)MSDM LMSDM i i n i=1ing the experiments. Before presenting our application- oriented evaluation protocols in Section 5, we will first Its value tends toward 1 (theoretical limit) when the explain how we measure the distortion induced by water- measured objects are visually very different and is equal to mark embedding and the various attacks against which we 0 for identical objects. The main reasons for choosing this would like to test the robustness. perceptual distortion metric are its strong robustness and its high correlation with the subjective evaluation results III. DISTORTION METRICS given by human beings [7]. IV. ATTACKSThe watermark embedding process introduces some amount of distortion to the original cover mesh. This In general, there are three kinds of routine attacks on a distortion can be measured geometrically or perceptually. watermarked mesh: file attack, geometry attack and con- For the geometric measurement, we propose to use the nectivity attack. In the following, we will give examples maximum root mean square error (MRMS). In general, for each kind of attack and present the corresponding the root mean square error (RMS) from one 3D surfaceS implementations in our benchmarking software. 0 to another 3D surface S is defined as A. File attack s Z Z 0 1 0 2 This attack reorders the vertices and/or the facets in thed (S;S ) = d p;S dS; (1)RMS jSj p2S mesh file, and does not introduce any modification to the mesh shape. A robust mesh watermark should be perfectly where p is a point on surface S,jSj is the area of S, and 0 invariant to this kind of attack. When carrying out thed(p;S ) denotes the point-to-surface distance between p 0 file attack, the benchmarking software uses a randomly andS . This RMS distance is not symmetric and generally 0 0 selected key to rearrange the vertex and facet indices in we haved (S;S ) =d (S ;S). Therefore, we canRMS RMS their corresponding lists in the mesh file. define the MRMS distance between a cover meshM and 0 its watermarked versionM as B. Geometry attack 0 0 0 In a geometry attack, only the vertex coordinates ared (M;M ) = max d (M;M );d (M;M) :MRMS RMS RMS modified while the mesh connectivity (i.e. the adjacency(2) relationship between vertices) is kept unchanged. OurDifferent from the simple vertex-to-vertex distance metrics benchmarking software integrates the implementation of(e.g. the vertex coordinates PSNR), MRMS measures the the following geometry attacks.surface-to-surface distance between two meshes. The dis- Similarity transformation. This operation includestortion measured by MRMS is more accurate, especially translation, rotation, uniform scaling and their combina-when the two meshes under comparison do not have tion. Like the above vertex/facet reordering operation, thethe same connectivity configuration. We have included similarity transformation always keeps the mesh shapethe legacy MRMS implementation of Metro [6] in our intact. Actually, these two kinds of operations are jointlybenchmarking software. called content-preserving attacks, through which a robustIt is well known that the geometric surface-to-surface watermark, or even a fragile watermark, should be able todistances, such as MRMS, do not correctly reflect the survive. In our implementation, in each run of the similar-visual difference between two meshes [7]. Thus, we need ity transformation, the watermarked mesh is successivelyanother perceptual metric to measure the visual distortion subject to a random translation, a random rotation and ainduced by watermark embedding. For this purpose, we random uniform scaling.have considered the mesh structural distortion measure Noise addition. This attack aims to simulate the arti-(MSDM) proposed by Lavoue´ et al. [7], and have in- facts introduced during mesh generation and the errorstegrated it in the benchmarking software. This metric induced during data transmission. We propose to addfollows the concept of structural similarity recently intro- pseudo-random noises on vertex coordinatesx accordingiduced by Wang et al. [8] for 2D image quality assessment, to the following equation (resp. y , z ):i iand well reflects the perceptual distance between two 3D 0objects. The local MSDM distance between two mesh x =x +a :d; (5)i ii 232Bunny model (V = 10%).where d denotes the average distance from vertices to cr object center, anda is the noise strength forx . The objecti i Finally, it is worth pointing out that it is important to center is calculated by using the analytic and continuous repeat the attacks with a random nature (i.e. file attack, volume moments of the mesh [9], which is much more similarity transformation, noise addition and cropping), for robust than simply calculating it as the average position at least 3 times, in order to ensure the reliability of the of the mesh vertices [10]. a is a pseudo-random number obtained robustness evaluation results.i uniformly distributed in interval [ A;A], with A the V. EVALUATION PROTOCOLSmaximum noise strength. Figure 1.(b) illustrates a noised Bunny model (A = 0:30%). The objective of a watermark evaluation protocol is Smoothing. Surface smoothing is a common operation to define the main steps to follow when conducting the used to remove the noise introduced during the mesh experimental assessment of a watermarking scheme. In the generation process through 3D scanning. For mesh wa- case of image watermarking, the authors of Stirmark [2] termark benchmarking, we choose to carry out Laplacian propose to first fix the watermark payload at about 70 bits smoothing [11] on watermarked meshes, with different and also to limit the induced distortion to be higher than 38 iteration numbersN while fixing the deformation factor dB in terms of PSNR. After that, Stirmark system carriesitr as 0:10. Figure 1.(c) shows a smoothed Bunny model out a series of attacks on the watermarked image. Then, the ( = 0:10;N = 30). user tries to extract watermarks from the obtained attackeditr Vertex coordinates quantization. This operation is stego images. Finally, several plots or tables are reported, which indicate the robustness metric (e.g. bit error ratelargely used in mesh compression. Under aR-bit uniform of the extracted watermark) versus the amplitudes of thequantization, the x (resp. y, z) coordinate of each vertex Ris rounded to one of the 2 quantized levels. different kinds of attacks. We define here two similar protocols for the evaluation C. Connectivity attack of robust mesh watermarking schemes. We call the first protocol perceptual-quality-oriented and the second oneIn a connectivity attack, the mesh connectivity infor- geometric-quality-oriented. The motivation for establish-mation, i.e. the adjacency relationship between vertices, ing two different protocols is that different mesh-basedis changed. Meanwhile, the coordinates of the original applications have very different restrictions on the geo-vertices may also be modified. We have implemented the metric and the perceptual distortions induced by water-following connectivity attacks in the software tool. mark embedding. For example, for the meshes used inSimplification. The original version of a mesh model digital entertainment, we should first of all ensure that(especially those obtained by a 3D scanning) usually has a the induced distortion is not annoying to human eyes (i.e.very high complexity, sometimes with more than 1 million the watermarked model should have a very high visualvertices. This high complexity is necessary to ensure a quality), while the amount of induced geometric distortiongood precision. In practical applications, the watermark is