As worldwide connectivity to the Internet has blossomed it has become quite convenient for a user to get whatever information he needs almost instantly. Works such as songs, movies, pictures, books, and magazines can be made available for immediate download. While the digital domain in the general sense has made it much easier for authors and legitimate distributors of multimedia works to create, manipulate, distribute and archive their property, it has also complicated the matter of copyright enforcement.

In this Internet-age context there are two challenges: (1) how to keep unauthorized recipients from obtaining copyrighted digital works and (2) how to prevent unauthorized re-distribution by legitimate recipients of a copyrighted digital work. In a sense, these challenges are not new, as these problems have been at the center of copyright management for centuries in the analogue (paper, etc) domain. However, new solutions are necessary because a copy of a digital work is essentially indistinguishable from the original, making a determination of authenticity impossible. This caveat threatens to undermine the digital distribution paradigm as a viable means to handle copyrighted material.

The first challenge is successfully addressed using methods such as encryption to make sure that only intended recipients are able to access copyrighted works from an author’s or legitimate distributor’s point of distribution. However, encryption cannot address the second problem, because eventually the encrypted work must be decrypted so that the legitimate recipients can access it. Once decrypted, the copyrighted work is again vulnerable. There have been recent legal developments in the regulation of copyrighted digital media (i.e. the D.M.C.A. in the United States in 1998), but these legal tools alone are not likely to solve the problems facing authors of digital works. For example, legislation spelling out penalties for possessing or distributing illegal copies of a digital work is not of much use if it cannot be determined which copies are legitimate and which are not. Where then can the enterprising digital author turn? One answer is the promising new field of digital watermarking.

The process of digital watermarking attempts to encode a signature into a digital work to provide a means by which legitimate copies can be identified. Depending on the application, this signature may take the form of a subscriber ID, information about the work, information about the author, or a URL to a related website. Strictly speaking, digital watermarking does not prevent a digital work from being illegally copied or re-distributed. Rather, it aims to make it more difficult, more expensive (time, money, etc.) to obtain an untraceable unauthorized copy of a work than it is to obtain a legitimate copy.

There are several tradeoffs and requirements to consider when implementing a digital watermarking scheme. For example, from a technical perspective, the watermark must be robust against intentional and unintentional attacks, but at the same time must modify the work only so slightly as to remain indiscernible. Also, the encoding/decoding processes must not be complex or computationally intensive to the point where the mechanism becomes cost prohibitive. Additionally, an implementation of a digital watermarking system must be convenient for the author/publisher in terms of time, ease of use and compatibility with his existing workflow.

A digital watermarking system consists of an encoder, which embeds identifying information in the work, and a decoder, which either detects or extracts the identifying information. These systems are often optimized for particular media or applications, but the general concepts remain the same. Here, main classes of proposed techniques for the encoding and decoding of watermarks are presented, along with a brief discussion of possible attacks. Examples of implementation for particular media are described to provide a better understanding.

The problem of encoding a watermark in a digital work can be viewed in terms of a traditional communications problem. Thus, the watermark is considered the signal of interest, which must be transmitted in such as way so as to withstand any distortions it might undergo in the process of being transmitted via the channel (the digital work) to the extent that proper detection and/or extraction are possible at the receiver (decoder). As stated previously, there is an additional requirement that the embedded watermark must not markedly change the host work. In a communications context, this requirement can been thought of as a power constraint at the transmitter (encoder) [1]. The communications solution to this sort of requirement set is use of spread spectrum techniques, which allow for low transmitted power at any one frequency and robustness to both intentional and unintentional distortion. This same way of thinking can be used for watermarking, where the pseudo-random sequences generated in the communications paradigm correspond to keys in a discussion on watermarking.

The first decision to be made during the encoding phase is to what aspect of the work to apply the watermark. This is commonly referred to as choosing the host feature. The host feature should be chosen, along with the embedding policy, such that it is difficult to damage or destroy the watermark without obviously reducing the quality of the work. It is indicative of a superior choice of host feature and embedding policy when a watermarked work must be effectively destroyed in order to remove the watermark. In the case of digital images, a watermark may be applied either directly (in the spatial domain) or in a transform domain. Embedding in the spatial domain involves modifying the pixel values of the image according to the policy. "The location for watermark embedding can be determined by low-level waveform processing or some higher-level processing such as edge-detection or feature extraction." Advantages of applying watermarks in the spatial domain are low complexity, low cost, and low delay. However, requirements for watermark robustness or invisibility can often be more easily visualized and in a transform domain. For example, in the case of a frequency domain representation, it is evident that a watermark embedding process should stay away from the low frequencies of the host image because changes to these are more like to visible to humans. Logically, high frequencies are also avoided because these could be distorted by an attacker with little effect on what a human would perceive [2].

After choosing the host feature, the embedding policy must be decided upon. The embedding policy decides how to combine the chosen feature of the host image with the watermark. The two main policies are additive embedding and multiplicative embedding. The additive policy is applied in the spatial domain where the resultant pixel values are given by y[i] = x[i] + Am[i]. A, then, is simply adjusted according to the local characteristics of the image to achieve a watermark that meshes well with the work. The multiplicative policy yields watermarked values by y[i] = x[i] + Am[i]x[i]. In both equations above, x[i] is the i-th member of the unmarked feature vector, m[i] is the i-th member of the watermark, A is a parameter controlling watermark strength and y[i] is the i-th member of the marked feature vector. A multiplicative policy provides the advantage of an image-dependent watermark (note x[i] is a part of the product added to the unmarked feature vector), which makes it less likely that collusion by a group of attackers would result in successful estimation of the watermark [2].

An item of additional interest is whether the unmarked host work is itself available to aid in choosing the optimum encoding strategy. This is the concept of informed versus blind embedding. In blind embedding, the host work is viewed as unknown noise that must be filtered to obtain the desired signal, the watermark. Actually, a better model views the host work not as additive noise but as valuable side information. Since the encoder knows what the host work is ahead of time, it can take "proper counter measures to reduce the impact of decoder blindness on watermark reliability." More simply put, even in the event that knowledge of the cover work is not available to the decoder, encoding can be done in such a manner that, despite channel distortion and attacks, the decoder has a better than otherwise chance of successfully detecting or extracting the watermark from the work [2].

As an example of the facets of encoding described above, consider a technique proven for embedding a watermark in a plain text digital work. It is known as line-shift coding, and involves vertically shifting lines of text in a document to embed a code word. In this case, line spacing is the host feature and the embedding policy dictates how the line spacing is modulated to embed the code. Figure 1 shows an example of line-shift coding where the second line has been shifted up by 1/300 inch (embedding policy) while the remaining 3 lines have not been shifted. This corresponds to an embedded code word of 0100. Note that while 1/300 inch is imperceptible by human eyes, it can be detected by the watermark decoding stage. Note also that in this simple case knowledge about the unmarked host work need not be explicitly provided to the decoder since it is assumed that the original work had uniform line spacing [3].

The decoding process has one of two main purposes. These are, as mentioned previously, either to detect the presence or absence of a watermark in a digital work, or to extract any message coded by the watermark. Further, elements of the decoding process can be grouped into four functional groups or blocks. These are (1) preprocessing and synchronization (2) domain transformation and projection (3) postprocessing and synchronization and (4) actual extraction or detection of the watermark. In the preprocessing block, unnecessary elements of the marked "signal" that could interfere with watermark extraction are removed. The decoding process is highly dependent on the encoding process as seen by the presence of the domain transformation and projection phase of the decoding process. This functional block transforms the preprocessed signal back into the domain where the actual embedding of the watermark took place. This transformed signal then undergoes some post processing and synchronization in order to optimally condition it (i.e. increase robustness) for the final decoding phase, detection/extraction [7].

In the final stage it is most helpful to use statistical modeling techniques to characterize the distortions the watermark has encountered along its path from encoder to decoder. With this sort of characterization, it is possible to utilize a statistical decision test, such as the Neyman-Pearson rule, to detect whether the signal entering the decoding process has a watermark embedded or not. Often the additive Gaussian noise channel model is well suited to describe effects of an unknown host signal and other distortions due to processing and attacks. Interestingly, "channel-coding techniques used in communications to transfer information more reliably through a noisy channel can also be applied in the watermarking context to improve the performance of the watermark extractor by adding redundancy that helps when the message carried by the watermark is extracted [7]."

Continuing with the example of line coding in a digital plain text work, it can be seen how the decoding process described above applies. To start, the digital version of the watermarked image received at the decoder is preprocessed to create a horizontal profile of each line in the work. Since, as discussed earlier, we encoded the watermark directly in the spatial domain, there is no domain transformation and projection stage in this case. Post processing includes compensation for known sources of distortion, leaving only additive Gaussian noise (the host work, from the decoders point of view). Actual watermark extraction is achieved by examining the spacing between lines by means of the horizontal profile. This spacing is measured between the baselines of adjacent text lines or between the centroids of adjacent text lines. Statistical techniques such as the well-known maximum likelihood decision rule are then applied to determine whether the line has been shifted up or down. The ability to make this distinction allows for a slight modification to the encoding strategy described previously for this example. To increase robustness, it is advantageous to only encode every other line. Thus each encoded line is sandwiched between two "control" lines. These control lines allow comparative cancellation of global distortion effects on the work. It should be noted that although this technique yields better robustness, it also decreases encoding capacity. That is, the number of encoded lines per page on a page with N lines is reduced to (N/2 – 1). Figure 2 shows a sample of a horizontal profile for three lines of text at a resolution of 300 dpi. The spacing between envelopes is the space between lines and the two peaks in each envelope correspond to the midline and the baseline in each line of plain text [8].

As noted previously, transmission of a watermark is subject not only to naturally occurring distortions and those intrinsic to the encoding and decoding processes, but is also subject to willful attacks. Attacks discussed here can be categorized into four classes: removal attacks, geometric attacks, cryptographic attacks, and protocol attacks.

Removal attacks attempt to completely remove the watermark without knowledge of the key that was used during the encoding process. If such an attack is successful, there is no retrievable trace of the watermark in the host work. Examples of attacks that fall in this class are denoising, quantization, remodulation and collusion attacks. Using statistical models for the watermark and the host work, attacks such as denoising and quantization can be optimized to severely damage the watermark while leaving the host work at an acceptable level of quality. Remodulation attacks attempt to change the watermark by applying modulation opposite to that used in the watermark embedding process. Collusion attacks utilize several copies of a host work, each with a different watermark. With enough copies (~10), the marked host works can be averaged or interleaved to successfully remove the watermark [10].

Rather than attempting to remove the watermark, geometric attacks strive to degrade the decoder’s synchronization with the watermark. In this case, the watermark information is still present in the host work and could be retrieved when synchronization is achieved. However, the price to the decoder, in terms of complexity of the synchronization algorithm, might by prohibitive. Examples of geometric attacks are scaling, rotation, and translation [2][10].

Cryptographic attacks try to find a way to remove a watermark or encode misleading watermarks. The basic goal is to find out what key the encoder is using to embed the watermark. This class of attacks is not practical because it is prohibitively complex and time consuming to search for the embedded information and reverse engineer the encoding process [10].

So-called protocol attacks use knowledge neither of the embedding technique nor of the watermarking key. Instead these attacks attempt to undermine the whole idea of watermark embedding. Two examples of this type of attack are the copy attack and the inversion attack. The copy attack uses an estimation of the watermark, derived from the watermarked host work, to copy that watermark to another work, known as the target data. In inversion, the attacker "subtracts his own watermark from the watermark of the host work and then claims to be the owner. [10]"

Despite these attacks, digital watermarking has been demonstrated to be an effective way to protect data in an insecure environment. Although not described here (see [10]), effective countermeasures against the aforementioned attacks have been developed that can successfully limit, if not eliminate the threat posed. In fact, the line-shift coding technique described earlier was used in 1995 to successfully distribute uniquely marked copies of an IEEE publication to over 2200 readers. More recently, a commercial realization of digital watermarking is Digimarc’s MediaBridge system [6], which handles and integrates digital and analogue versions of watermarked works. It can recognize watermarks in the analogue domain using a standard PC camera and can then trigger the web browser to load appropriate pages, possibly concerning the work or the author of the work. As research progresses in this relatively new field of digital watermarking, we are sure to see other innovative applications of the technology emerge.