Euclidean Distance Distortion Based Robust and Blind Mesh Watermarking

— The three-dimensional (3D) polygonal meshes are recently widely used in several domains, which necessitate the realistic visualization of the objects. Moreover, there is an urgent need to protect the 3D data properties for preventing unauthorized reproduction. The 3D digital watermarking technology is one of the best solutions to protect data from piracy during transmission through the internet. The current work proposed a novel robust watermarking scheme of polygonal meshes for copyright protection purposes. The proposed algorithm is based on the characteristics of the mesh geometry to embed a sequence of data bits into the object by slightly adjusting the vertex positions. Furthermore, the proposed method used a blind detection scheme. The watermarked model is perceptually indistinguishable from the original one and the embedded watermark is invariant to affine transformation. Through simulations, the quality of the watermarked object as well as the inserted watermark robustness against various types of attacks were tested and evaluated to prove the validity and the efficiency of our algorithm.

I. InTRoducTIon R ecenTly, due to the rapid growth of computer graphics and computer vision, 3D models are widely used in several applications [1], [2]. In the 3D computer graphics, 3D modeling aims to create realistic visual content of objects in suitable structure for rendering and display.
Numerous other scientific domains rely on the analysis of such geometric data. In the mechanical field, virtual 3D models simulate critical performance engineering attributes for mechanical systems. In culture heritage, these models assist the preservation of archaeological sites and virtual museums achievement. In architecture, these models have the potential to truly advance the project impact. A similar abundance of 3D models can be observed in other disciplines, including scientific and medical applications [3], [4], entertainment industry (movies, cartoons and video games) and in electronic commerce to build Customer Relationships.
In this imminent scenario, it is obligatory to develop techniques to protect the original 3D data ownership and to prevent their unauthorized copying. Typically, the digital watermarking is probably one of the best solutions for data protection and authorization. The basic idea of the digital watermarking is to combine information to the media in a persistent way. The watermark is embedded by changing properties or some features of the digital media. Thus, the associated data is indispensably attached to the host media. This combination can be used for many different applications such as copyright protection where the watermark carries data about the owner or the creator of the digital media. The watermarks used for copyright protection are often called robust watermarks that provide an evidence of the owner's identity and control the model illegal reproduction.
Watermarking 3D models [5]- [7] was a relatively new digital watermarking frontier through inserting information into 3D models [8] in an imperceptible way. Compared to the 2D watermarking [9], [10], the 3D technique is more complex due to the increased complications associated with 3D objects in arbitrary shapes. The design of these algorithms is considered difficult mainly due to the existence of many insoluble geometrical and topological attacks. The geometric attacks alter only the vertices positions; however, the connectivity attacks can completely change the geometry and the connectivity information of the watermarked mesh. Other common operations used in various applications are similarity transformations which include translation, rotation and uniform scaling. When performing these basic operations on watermarked object, the inserted watermark must be completely preserved.
In this paper, a new robust and blind watermarking algorithm based on the alteration of the vertices positions in order to embed the watermark bits aiming to protect the intellectual property of the 3D objects was presented. The proposed approach is robust to affine transformations. It was applied to the triangular polygonal meshes and it modified only the geometrical data. The rest of the paper is organized as follows. The related works are described in Sect. 2. In Sect. 3, the new watermarking approach is presented. The experimental results are presented in Sect. 4. Finally, Sect. 5 concludes the work.

II. RelATed woRks
Generally, the mesh watermarking techniques inserts the watermark by modifying the geometry of the polygonal models [11], [12]. Some of these algorithms are spatial approaches and the embedding process modifies the vertices positions and geometrical invariants. The earliest 3D watermarking algorithms were proposed by Ohbuchi et al. [13]. A variety of techniques in the spatial domain such as Triangle Similarity Quadruple method (TSQ) were suggested. This method was blind and modified the triangular mesh geometry; however it was not robust to connectivity attacks. Benedens [14] proposed two robust watermark algorithms with high insertion capacity. The author carried out a flood vertex algorithm to modify the model geometry. It does not require the object topology during the watermarking scheme. This algorithm was based on the modification of the vertex position by changing the distance between the vertex to be watermarked and the center of gravity of a reference triangle chosen in order to bring the vertex in the desired range. Moreover, the author proposed another watermarking scheme, namely the flood triangle algorithm. This algorithm employed both the geometrical and topological information to generate a single path of the mesh triangles. The triangles vertices in this path were modified to insert the watermark bits by changing the height of the triangles.
The robust watermarking algorithm of Harte et al. [15] was based on modifying the locations of selected vertices according to the watermark bit to be embedded. Two different envelopes based on the separation plane and ellipsoidal were considered for inserting the watermark. The bit '1' is inserted by moving the vertex inside the envelope defined by the neighbors' vertices. However, to encode the bit '0', the vertex was moved outside the envelope. The watermark can be recovered after affine transformations. The algorithm proposed by Zafeiriou et al. [16] embedded the watermark bit in multiple vertices. The mesh was normalized, thus the model was translated and rotated so that its mass center coincides with the origin of the coordinate system. The principal component was aligned with the z axis. Afterward, the vertices coordinates were transformed from the Cartesian to spherical coordinates. The embedding process was achieved by altering the norm values of the selected vertices. The proposed algorithm was robust to affine transformations, noise addition and simplification, but fragile to cropping. Cho et al. [17] proposed two blind and robust watermarking methods which alter the distribution of vertex norms. The first method changed the mean value of the distribution and the second modified its variance. The proposed approaches were robust against similarity transformations and vertex reordering. However, they were less robust against various other types of attacks. Wang et al. [18] proposed a robust and blind watermarking algorithm based on volume moments. The scheme used cylindrical domain to decompose the mesh into patches after its normalization. Then, the watermark was inserted in each patch by quantizing the zero order moment. The experimental results illustrated watermark imperceptibility and robustness under various attacks. Zhan et al. [19] proposed a robust and blind watermarking algorithm for polygonal meshes based on vertex curvature. The insertion process first calculated the root mean square curvature for each vertex then separates it into bins according to the ordered fluctuation values. The watermark bits were embedded by modulating the root mean square curvature fluctuation. The algorithm presented good robustness under various attacks.

III. The MeThodology And PRoPosed wATeRMARkIng fRAMewoRk
The framework is characterized by blind extraction of the inserted watermark. The watermark is represented by a unique sequence of bits representing the copyright signature to be inserted. The proposed algorithm provided an invariant embedded watermark to the affine transformation, including translation, rotation and uniform scaling. In order to evaluate the proposed system, a data set of four 3D triangular mesh models provided by Stanford University as test models: Bunny (34835 vertices and 69666 faces), Dragon (50000 vertices and 100000 faces), Hand (36619 vertices and 72958 faces) and Cow (2904 vertices and 5804 faces) were used.

A. Watermark embedding
The adopted embedding scheme is an imperceptible adjusting of some selected vertices positions. The modification is performed due to the quantization of the Euclidean distance between the mass center of the model and the selected vertices in order to insert the code bits. This approach introduced a bit of the signature in each vertex. Figure 1 demonstrated the robust watermark embedding scheme specifying the following steps.
The proposed algorithm is first identified the vertices that will be watermarked as illustrated in Figure 1. The vertices are selected based on a secret key that will be used in the extraction process to identify the watermarked vertices. The use of a secret key ensures the watermarking security in both the insertion and the extraction processes. Since, the turbo encoder results from the association of two or more encoders which are Recursive Systematic Coder (RSC). It provides three outputs, so it can distribute information even if one part of the message is damaged, still information exist elsewhere. Consequently, the watermark to be embedded in the current work is encoded using the turbo code [20], [21] which is an error correcting code. This code adds redundancy to the embedded information used to correct errors caused by disturbances and improve robustness against attacks. It is obvious that using a correcting code is more efficient than a simple duplication of watermark bits.
Decoding is considered to be collaboration between the decoders to exchange the information in an iterative manner to improve the reliability of decision on each decoded bit. Iteration involves the activation of each decoder once. Hence, the more iterations over the turbo decoder leads to converge toward the right solution.
The mesh geometry M(F,V) consists of faces where F specifying their connectivity and a set of vertices V={v 1 ,….,v n } with v i ∈ R 3 , n is the number of vertices. The mass center K of the model is calculated using following expression: The Euclidean distance d from a selected vertex to the mass center is defined by (2).
Where {v ix , v iy , v iz } are the coordinates of the vertex.
After calculating the Euclidean distance from the mass center and selected vertices, this distance is modulated according to the bit value to be embedded. The distance is divided into intervals using the embedding scale e which is provided from the following expression: Where, D is the furthest Euclidian distance from the faces center to the mesh center of mass dCf i obtained by (4), and m is a specified value. The faces center Cf i of a given triangular face f i is provided by (5).
Where, V ij are the vertices of the face f i .
To embed the watermark bits w(i), the integer N i is calculated using (6) specifying the intervals number within the distance d i where As a convention, the intervals are assigned by alternation the bits '0' and '1' beginning with the bit '0'. If w(i) is 0, selected vertex V i position should be modified so that N i is an odd value and an even value if w(i) is 1. This change is implemented by decreasing the Euclidean distance between the vertex V i and the mass center K from d to d'. The position of the selected vertex will be slightly changed according to the modulated distance d'. The coordinates of the marked vertex V i' are adjusted to be in the desired position using the following expression: The embedded watermark in the proposed approach is invariant to any affine transformations. In fact, the ratio between the Euclidian distance from the selected vertices to the mesh mass center and the embedding scale e which is proportional to the mesh geometry remains the same after applying translation, rotation or uniform scaling transformations to the model. In order to obtain a small embedding scale e ensuring a minimal distortion in the resulting watermarked model by assigning m a large value.

B. Watermark distorsion
The watermark insertion introduced some amount of distortion to the original meshes. This distortion must be imperceptible to maintain the object value. In fact, the basic requirement for any watermarking system is the quality of the watermarked media. The embedding process should not introduce noticeable changes.
The quality of the 3D mesh geometry was measured by the maximum root mean square error (MRMS) using Metro [22]  Attacks are a critical factor in the design of mesh watermarking algorithms to evaluate the robustness performance of the watermark. Typically, most attacks are extrapolated from image attacks and adapted to the polygonal meshes. In addition there are other specific and sophisticated attacks to polygonal mesh such as simplification and subdivision The robustness is evaluated in terms of the correlation between the extracted watermark bit sequence B and the originally inserted one A as given by the following equation [23]: Where A and B respectively indicate the average of the watermark bit sequence A and B and n is the watermark size.
In addition, the errors are measured on the extracted watermark by the bit error rate (BER) determined as a ratio of the total lost bits to the total embedded bits.

C. Watermark extraction
The watermark extraction steps are almost the reverse of the watermark insertion algorithm steps. In this blind extraction process, the secret key generated in the insertion process is used to restore the watermark. Figure 2 illustrates the blind watermark extraction scheme. As demonstrated in Figure 2, the watermarked vertices are selected using a secret key and the mass center is calculated. Afterward, the Euclidean distance from the mass center and the watermarked vertex are computed and divided into intervals using the embedding scale e. The watermark bit is simply reported according to the intervals number. This process continues until all the watermarked information is extracted. The final step is the recovery of the initial watermark using the turbo code decoder.

IV. exPeRIMenTAl ResulTs
A set of experiments was conducted without attacks on the used dataset using the proposed watermarking scheme to evaluate its effectiveness. In addition, another set of experiments was conducted under various types of attacks. The inserted watermark imperceptibility is evaluated using the watermarked model without attacks. After that, a set of attacks reported in [24] is applied on the watermarked object to evaluate the robustness and the resistance of the embedded watermark. The 3D attacked object quality is also evaluated.

A. Proposed system evaluation without attacks
The watermark imperceptibility is a crucial requirement for a robust 3D watermarking used to protect copyright. In addition, it is important that the watermarked object keep the same visual appearance as the original one to serve for its typical expected use. The size of the watermark in these tests is 64 bits inserted by redundancy using a turbo code to ensure better robustness. Figure 3 demonstrates the 3D tested objects along with the corresponding watermarked meshes.  Figure 3 depicts that compared to the original objects; the watermarked corresponding objects prove the invisibility of the applied changes. Visually, the watermark is completely invisible and does not affect the shape and the appearance of the watermarked objects. Table 1 provides the quality evaluation results using the MRMS based on the expression in equation (8).  Table 1 depicts that the MRMS values prove the better quality of the watermarked models and the imperceptibility of the embedded watermarks. A slight loss of information is caused by the proposed algorithm.
The watermark was inserted into the object and recovered successfully when no attack was considered. This is checked by the BER measure which is equal to 0 and a measure of correlation equal to 1 for all the test objects.

B. Proposed system evaluation under various types of attacks
The robustness results and the resistance of the embedded watermark under different types of attacks are discussed. Some of these attacks are innocent, which may be used to adapt the object to personal use, while others are malicious, on which the watermarking algorithms try to resist. These attacks can be classified into two categories: geometric attacks and connectivity attacks. Geometric attacks modifies only the geometry of the watermarked mesh, i.e. the vertices coordinates. The number of vertices and the connectivity information are always kept unchanged. Affine transformations, noise addition, smoothing and uniform coordinate quantification are considered as geometric attacks.
Connectivity attacks are mainly mesh simplification, subdivision and cropping. In these attacks, the first combinational elements (vertices, edges and facets) of the watermarked mesh can be removed while some new elements can be inserted. In general, connectivity attacks are much more difficult to handle. Figure 4 illustrates examples of attacked models. The algorithm is also tested under geometry attacks. Table 2 provides robustness results against the uniform noise addition. Table  2 establishes that the proposed scheme has a high robustness against noise addition. From the BER results, an average of 70% of the watermark is recovered in the case of the amplitude 0.5%.   Tables 3 and 4 depict that for smoothing attack the robustness is very satisfactory with a BER average of 0.17. Furthermore, we can deduce that robustness evaluations under uniform coordinate quantization are very acceptable. Furthermore, the robustness of the proposed algorithm against connectivity attacks including simplification, subdivision and cropping is evaluated. Table 5 presents the robustness evaluations against mesh simplification attack. Simplification is a strong attack that changes the object mesh which affects the inserted watermark. As an example, using BER results for the dragon model, more than 80% of the watermark after having removed 90% of the vertices is achieved. Consequently, the results are very satisfactory for models under such heavy attacks. Tables 6 and 7 display the robustness evaluation against subdivision and cropping; respectively.
Tables 6 and 7 establish that the subdivision attacks include the midpoint scheme, the sqrt3 scheme and the loop scheme [25]. It is clear that the proposed algorithm presents a high robustness against these attacks. Cropping is a very strong attack where one part of the object is cut off and lost. This damage causes a loss of information that affects the number of vertices, faces or edges. However, the recovery rate of the watermark is very satisfactory with respect to the implemented changes and this is due to the redundancy of the watermark embedding.
Generally, the correlation results prove a high robustness in most cases for all attacks. Moreover, the quality of the attacked watermarked test objects is evaluated using MRMS. It is obvious that the stronger the attack is, the higher the MRMS values are and therefore the more the object quality decreases.
From the preceding results it is reported that high robustness of the proposed algorithm against the applied disturbances is achieved. This proves the proposed watermarking scheme ability to withstand most attacks. From the experimental results evaluation, the robustness of the inserted watermark is ensured, which ensures the validity of the proposed robust watermarking algorithm. Although the results are positive and promising, there was a principal limitation, namely the simplification attack is the most destructive of the inserted watermark. Further evaluation will be focused on increasing the watermark robustness of the proposed method to other types of attacks as a future work.

V. conclusIon
In this paper, a new and blind mesh watermarking approach was proposed. This method is a robust 3D watermarking scheme dedicated to copyright protection and characterized by a blind extraction of the inserted watermark. The watermark embedding was achieved by slightly shifting vertices' positions. The proposed algorithm has the advantage of causing no clear alterations in the host model during the insertion process; otherwise it is invariant to similarity transformations. Moreover, it proved to be highly robust against a variety of attacks, such as noise addition, smoothing, quantization, simplification, subdivision and cropping. This was also improved by using the Turbo code on the watermark. The experimental results show that the requirements of the watermark imperceptibility and robustness are very satisfactory.