accesses since September 10, 1998 
copyright notice
link to published version: Networker, September, 1998
accesses since September 10, 1998 What does the head of Histiaeus' slave and a new hundred dollar bill have in common? Both were watermarked.
Ben Franklin fared better than the slave. Franklin's ghostly image appears when you hold the hundred dollar bill to the light, leaving his foreground image no worse for wear. Histiaeus' slave, more's the pity, actually had his head shaved, tatooed, hair regrown and re-shaved just so Histiaeus could send a hidden message to another Greek soldier. One lesson to be learned is that steganography could be painful in the fifth century B.C.
The technique of watermarking paper (rather than heads) is almost as old as paper manufacturing itself, dating back to the late middle ages. Their earliest use seems to have been to record the manufacturer's trademark on the product so that the authenticity could be clearly established without degrading the aesthetics and utility of the stock (cp. http://www.ipst.edu/amp/watermk.html). In more recent times, watermarks have also been used to certify the composition of the paper, including the nature of the fibers used. Basically, watermarks are added during the paper manufacturing process in two stages. First, a "half-stuff" slurry of fiber and water are poured into mesh molds to collect the fiber. Second, the slurry is dispersed within "deckle" frames to add shape and uniformity, and squeezed under great pressure to expel the water. The fibers cohere in the mold and become paper with the reverse impression of whatever form, image or text might have been on the "negative" mold. Such watermarks have historically been very difficult to counterfeit than the images they lie under. Experience with watermarks was so successful, that governments began to watermark their currencies, postage stamps, revenue stamps, etc. to thwart counterfeiting.
The digitization of our world expanded our concept of watermark to include immaterial, digital impressions for use in authenticating ownership claims and protecting proprietary interests. However, in principle, digital watermarks are not unlike their paper ancestors. They signify something about the token of a document or file in which they inhere . Whether the product of a Fourdrinier paper press or a discrete cosine transformation , watermarks of varying degrees of obtrusiveness are added to presentation media as a guarantee of authenticity, quality, ownership, and source.
The enormous popularity of the World Wide Web in the early 1990's demonstrated the commercial potential of offering multimedia resources through the digital networks. Since commercial interests seek to use the digital networks to offer digital media for profit, they have a strong interest in protecting their ownership rights. Digital watermarking has been proposed as one way to accomplish this.
Unfortunately, so many of the terms used in discussions of watermarking are so broadly defined, orthogonal to one another, and derived from other areas that a neat-looking taxonomy of features difficult to achieve. For one thing, digital watermarking, digital steganography, digital fingerprinting, and data hiding are all related concepts. In each case, a digital signal or pattern is inserted into, onto, before, or after a digital document (graphic, audio file, text document, MPEG animation, etc.). However, there are subtle differences between these techniques, as well as subtle differences over the meanings of the terms. We will suggest some working definitions below, but remind the reader that the use of these terms falls short of orthodoxy.
Watermarks involve the transformation of a digital artifact into another token of the same type. For example, the transformation in Figure 1 involved the addition of the circular watermark. In this sense, digital watermarking may be distinguished from digital fingerprinting - the creation of a second file (or file fragment) that "describes" the original file's content. In terms familiar to computists, watermarking is done at the object-level while fingerprinting is done at the meta-level. As a simple example, the checksum field of a disk sector might be considered a primitive fingerprint of the preceding block of data. Similarly, hash algorithms produce fingerprint files, as to digests of data streams.
Steganography is the practice of "hiding" messages. A watermark is a special case of a steganograph - (vs. Histaeus' battle plan on the head of the slave). However, it is not uncommon to find practitioners who use these terms interchangeably - with an occasional individual, confounding both with fingerprinting.
Watermarks in the general sense are object-level transformations of digital artifacts (alt: files) into tokens of themselves. Watermarks may be perceptible or imperceptible. Perceptible watermarks, like the visible watermark in Figure 1, serve primarily as a statement of ownership, authorship or source. Imperceptible watermarks are used for more sophisticated applications of document identification in situations where the watermarked object must appear unaltered, at least up to some viewing threshold.
Watermarks may also be robust or fragile according to whether they withstand, or fail to withstand, standard digital editing techniques without noticeably altering or degrading the original artifact. For example, invisible watermarks that are imperceptible under normal viewing, and that survive basic image modifications, would be classified as at least persistent if not robust. Watermarks (cf. Figure 1) which could be edited out of the artifact, would be said to be fragile, etc.
Finally, robust watermarks may use encryption - either public- or private-key. Under popular usage, encryption transforms a source file into another form in such a way that the source becomes un-usable without an appropriate peruser and the decryption key. However, in the case of watermarking, the encryption is embedded into an artifact which remains fully usable.
Of the classification schemes which apply to watermarks, the distinction between perceptible and imperceptible seems to be the most fundamental. This distinction cuts across media types while at the same time constraining the ultimate use of the watermark technology. For example, visible watermarks, as perceptible watermarks, are used in much the same way as their paper ancestors - to identify the source or ownership of a document. Invisible watermarks, as imperceptible watermarks, on the other hand are kind of like magic ink - they hide information in documents. This impacts the range of suitability of these two categories of watermarks as we'll discuss, below.
The image in Figure 1 illustrates the technique of visible watermarking. The circular watermark is clearly seen around the left part of the image. In the right most part of the image, the watermark tends to hide in the busiest part of the image. The process of hiding watermarks is illustrated in Figures 2a and 2b. In Figure 2a, the color of the star-shaped watermark easily contrasts from the color of the image to, whereas in Figure 2b the watermark's color tends to blend into the image.
Digital copy of Arabic manuscript with digital watermark superimposed.
Source: IBM's Digital Library project. Used
with permission.
Figure 2a: Watermark with contrasting colors - highly visible
Figure 2b: Watermark with complementing colors that tend to blend into
the background
The type of watermark influences the effectiveness of the watermark in various applications. For example, both perceptible and imperceptible watermarks can deter theft, but they do so in very different ways. Perceptible watermarks are especially useful for conveying an immediate claim of ownership. The main advantage of perceptible watermarks, in principle at least, is that they virtually eliminate the commercial value of a document or media object without significantly lessening the document's utility for legitimate, authorized purposes. That is to say, the watermark in Figure 1 makes it clear that the document belongs to someone, but it does this without preventing the appreciation of the artifact. A familiar example of a visible watermark is in the video domain where CNN and other television networks place their translucent logo at the bottom right of the screen image.
Imperceptible watermarks on the other hand are only effective as a theft deterrent if the potential thief has a reason to believe that watermarks might be present, and further that they may be used to prosecute unauthorized possessions. If we assume that the majority of potential thieves are at best Acomputationally challenged, @ an imperceptible watermark would be very ineffective. However, though weak in terms of discouraging theft, imperceptible watermarks really shine as a means of identifying the source, version or serial number, author, creator, owner, distributor or authorized consumer of a document or image. For this purpose, the objective is to permanently and unalterably mark the image so that the credit or assignment is beyond dispute. In the event of illicit usage, the watermark would facilitate the claim of ownership, the receipt of copyright revenues, or the success of prosecution.
In some cases, both watermarking schemes are equally effective. For example, both may be used to determine the location, and trace image migration, of documents over the networks. Several computing companies are developing the software to deploy watermark agents in network patrols to detect infringement. It should be remembered that watermarking software can assign a unique watermark to each document or object for each authorized user or consumer.
Though neither exhaustive nor definitive, Table 1 shows some anticipated primary (p) and secondary (s) benefits to digital watermarking.
TABLE 1:
Perceptible and imperceptible watermarks act as a deterrence to theft in different ways.
Perceptible watermarks diminish the commercial value of the document or image.
Imperceptible watermarks increase the likelihood of successful prosecution and may also
act as a deterrent if the criminal is sufficiently computer literate.
purpose |
perceptible |
imperceptible |
| determine ownership | p | p |
| validation of intended recipient | - | p |
| non-repudiable transmission | - | p |
| deterrence against theft | p | p (caveat) |
| meta level, content labeling | - | p |
| diminish commercial value without diminished utility | p | - |
| discourage unauthorized duplication | p | p (caveat) |
| authentication | s | p |
| identify document source | p | p |
| network patrolling (e.g., on Web) | s | p |
| rights management (e.g., "copies remaining@) | s | p |
The "litmus test" for watermarks includes the qualities of persistence, robustness and unobtrusiveness as explained below:
To these qualities, we might also add for the sake of law-enforcement
Although in principle digital watermarks may be embedded in any digital medium, by far most published research on watermarking to this point deals with graphics images and text. We'll restrict our attention to these two categories in the discussion, below.
Robust image watermarking commonly takes on two forms: spatial domain and frequency domain. One spatial domain watermarking technique mentioned in the literature slightly modifies the pixels in one of two randomly-selected subsets of an image. Modification might include, e.g., flipping the low-order bit of each pixel representation. It is easy to see how this would have little perceptible effect on the image when viewed with the common 24-bit color gamuts used today in monitors of generic home/office computers. Of course this will work well only if the image will not be subject to any human or noisy modification, but it does seem to hold up well under lossy image compression and selected filtering techniques.
Spatial watermarking can also be applied using color separation such that the watermark appears in only one of the color bands. This renders the watermark sufficiently subtle that it can be for all intents and purposes imperceptible. However, the watermark appears immediately when the colors are separated for printing. This renders the document useless to the printer unless the watermark can be removed from the color band. This approach is used commercially for journalists to inspect digital pictures from a photo-stockhouse before buying un-watermarked versions.
Watermarking can be applied in the transform domain, including such transforms are Fast Fourier, discrete cosine, and wavelet. In the case of frequency transforms, the values of chosen frequencies can be altered from the original. Since high frequencies will be lost by compression or scaling, the watermark signal is applied to lower frequencies, or better yet, applied adaptively to frequencies that contain important information of the original picture (feature-based schemes). Since watermarks applied to the frequency domain will be dispersed over the entirety of the spatial image upon inverse transformation, this method is not as susceptible to defeat by cropping as the spatial technique. However, there is more of a tradeoff here between invisibility and decodability, since the watermark is in effect applied indiscriminately across the spatial image. Other transform domain techniques have their own particular characteristics with respect to the litmus test, above.
Watermarking can be applied to text images as well. Three proposed methods are: text line coding, word space coding, and character encoding. For text line coding, the text lines of a document page are shifted imperceptibly up or down. For a 40-line text page, for instance, this yields 2**40 possible codewords. For word-shift coding, the spacing between words in a line of justified text is altered. Of course, the watermark can be defeated by retyping the text.
FIGURES 3a-c: Text line watermarking. The first and third lines of the
original text in (3.a.) is lowered by 1 pixel in (3.b). (effectively imprinting the code
101..... into the document). The change is highlighted in (3.c.)
In 1997, a counterfeiting scheme was demonstrated for a class of invertible, feature-based, frequency domain, invisible watermarking algorithms. This counterfeiting scheme could be used to subvert ownership claims because the recovery of the digital signature from a watermarked image requires a comparison with an original. The counterfeiting scheme works by first creating a counterfeit watermarked copy from the genuine watermarked copy by effectively inverting the genuine watermark. This inversion creates a counterfeit of the original image which satisfies two properties: (a) a comparison of the decoded versions of both the original and counterfeit original yields the owner's (authorized) signature, and (b) a comparison of decoded versions of both the original and counterfeit original yield the forged (inverted) signature. This, the technique of establishing legitimate ownership recovering the signature watermark by comparing a watermarked image with the original image breaks down. It can be shown that both the legitimate signature and counterfeiter's signature inhere in both the watermarked and counterfeit watermarked copies. Thus, while it may be demonstrated that at least one recipient has a counterfeit watermarked copy, it can not be determined which it is.
This research suggests that not all watermarking techniques will be useful in resolving ownership disputes in courts of law. There will likely be non-commercial applications, or those with limited vulnerability to theft, where "good enough watermarking" will suffice. More sensitive applications may require non-invertable or non-extracting watermarking techniques. These issues are under consideration at this writing.
Though digital watermarking of various types has been around since at least the early 1990's, the remaining open questions seem to be in a continuous-growth mode. In 1996, we thought the important questions were whether perceptible or imperceptible watermarks had the greatest applicability, how one might define an acceptable "threshold of imperceptibility", whether original images should be required for decoding, and how watermarks would be policed. With many of these questions unanswered, or only partially answered, we now add to the list. How might one characterize "Good-Enough Watermarking," perhaps akin to Phil Zimmerman's Good Enough Privacy, for widespread use on the Internet and Web and for a wide variety of different commercial and non-commercial applications? What constitutes "reasonable" levels of persistence and robustness? What type of attacks must be anticipated, and how significant are they across application domains? Should watermarks be decodable without comparison to the original document?
In 1996 we wrote: "As scientists propose solutions and publishers experiment with them and debate their merits, some methods of watermarking will emerge as useful and widely used. When that happens, there will also be the emergence of external agencies for monitoring electronic copyright infringement (much the same as there are agencies for music and print copyright management). In the meantime, the challenge is for the scientists to develop ever more invisible, decodable, and permanent watermarking methods, and perhaps to meet even more specifications as they are demanded. This remains a true today as it was in 1996.
For an early look at watermarking techniques, see our article, Protecting Ownership Rights through Digital Watermarks in hardcopy at IEEE Computer, 29:7 (1996), pp. 101-103 or in electronic version The special section of the Communications of the ACM on Digital Watermarking, 41:7, July, 1998, pp. 31-64, is a good sequel to this article which contains many useful references.