Image Watermarking in Higher-Order Gradient Domain

The use of the wavelet transform to analyze the behaviour of the complex systems from various fields started to be widely recognized and applied successfully during the last few decades. In this book some advances in wavelet theory and their applications in engineering, physics and technology are presented. The applications were carefully selected and grouped in five main sections - Signal Processing, Electrical Systems, Fault Diagnosis and Monitoring, Image Processing and Applications in Engineering. One of the key features of this book is that the wavelet concepts have been described from a point of view that is familiar to researchers from various branches of science and engineering. The content of the book is accessible to a large number of readers.


Introduction
With the widespread use of Internet and digital multimedia technologies, the interest in copyright protection of digital content has been rapidly increased.Digital watermarking has emerged as a possible solution for intellectual property rights protection.Watermarking has also proven to be a promising tool in many applications such as broadcast monitoring, fingerprinting, authentication and device control.In digital watermarking, additional information, called the watermark,isimperceptibly embedded into the original digital content.
Different applications pose different requirements on watermarking.For example, fragile watermarking is required in content authentication applications, while in applications such as copyright control the watermark should be robust to attacks 1 .In each application, the watermarking method makes a trade-off between the perceptual invisibility, robustness, security, data capacity and availability of side information.For instance, to increase the robustness of a watermark, the watermark strength needs to be increased, which in turn may make the watermark more visible.The invisibility requirement of watermarking limits the maximum amount of watermark bits (watermarking capacity) that can be embedded into a digital signal.
In the last two decades, a lot of work has been done in the field of image watermarking.The reader may refer to (Cox, 2008) for a survey of watermarking methods.Watermarking approaches can generally be classified into two categories (Wu & Liu, 2003): spread spectrum (SS) based watermarking (Cox et al., 1997;Podilchuk & Zeng, 1998) and quantization based watermarking (Chen & Wornell, 2001;Kundur & Hatzinakos, 2001;Moulin & Koetter, 2005).Below, these two approaches are discussed with some detail.

Spread spectrum watermarking
In general, any watermarking system that spreads the host signal over a wide frequency band can be called spread spectrum watermarking (Barni, 2003).In most SS type methods, a pseudo-random noise-like watermark is added (or multiplied) to the host feature sequence (Cox et al., 1997).While SS watermarking methods are robust to many types of attacks, they suffer from the host interference problem (Cox et al., 1999).This is because the host signal itself acts as a source of interference when extracting the watermark, and this may reduce the detector's performance.
The first approach to alleviate this problem is through designing better embedders at the encoder side.For example, the improved SS (ISS) method proposed in (Malvar & Florencio, 2003) exploits the information about the projection of the signal on the watermark.This knowledge is then used in the embedding process to compensate the signal interference.
Another approach to improve the performance of SS watermarking methods is to use the statistics of the host signal in the watermark detection (Zhong & Huang, 2006).Based on the distribution of the coefficients in the watermark domain, different types of optimum and locally optimum decoders have been proposed (Akhaee et al., 2010;Barni et al., 2003;Cheng & Huang, 2001;Hernandez et al., 2000;Kalantari et al., 2010).

Quantization-based watermarking
To overcome the host-interference problem, the quantization (random-binning-like) watermarking methods have been proposed.Chen and Wornell (Chen & Wornell, 2001) introduced quantization index modulation (QIM) as a computationally efficient class of data-hiding codes which uses the host signal state information to embed the watermark.In the QIM-based watermarking methods, a set of features extracted from the host signal are quantized so that each watermark bit is represented by a quantized feature value2 .It has been shown that the QIM methods yield larger watermarking capacity than SS methods (Barni et al., 2003).The high capacity of these methods makes them more appropriate for data hiding applications.
Researchers have proposed different quantization-based watermarking methods.Gonzalez and Balado proposed quantized projection method that combines QIM and SS (Perez-Gonzlez & Balado, 2002).Chen and Lin (Chen & Lin, 2003) embedded the watermark by modulating the mean of a set of wavelet coefficients.Wang and Lin embedded the watermark by quantizing the super trees in the wavelet domain (Wang & Lin, 2004).Bao and Ma proposed a watermarking method by quantizing the singular values of the wavelet coefficients (Bao & Ma, 2005).Kalantari and Ahadi proposed a logarithmic quantization index modulation (LQIM) (Kalantari & Ahadi, 2010) that leads to more robust and less perceptible watermarks than the conventional QIM.Recently, a QIM-based method, that employs quad-tree decomposition to find the visually significant image regions, has also been proposed (Phadikar et al., 2011).
Since QIM methods do not suffer from the host-interference problem, their robustness to additive Gaussian noise is higher than that of SS methods.However, they are very sensitive to amplitude scaling attacks.Even small changes in the image brightness can significantly increase the bit error rate (BER) (Li & Cox, 2007).During the last few years, many improved techniques have been proposed to deal with this issue.These methods can be classified into the following main categories (Perez-Gonzalez et al., 2005): • The first type of methods embed a pilot sequence in the signal (Eggers, Baeuml & Girod, 2002;Shterev & Lagendijk, 2005;2006).Since the sequence is known to the decoder, it can be used to estimate any change in the signal amplitude.• The second type of methods rely on designing amplitude-scale invariant codes, such as Trellis codes (Miller et al., 2004), orthogonal dirty paper codes (Abrardo & Barni, 2004) and order-preserving lattice codes (Bradley, 2004).
Among these methods, watermarking in a gain-invariant domain seems to be the best solution (Perez-Gonzalez et al., 2005).

The outline
The aim of this chapter is to describe how to insert robust, imperceptible and high-capacity watermark bits using a gain-invariant domain.Towards that goal we describe the gradient direction watermarking (GDWM) method (N.Arya et al., 2011).In this method, the watermark bits could be inserted into the angles of vectors of a higher-order gradient of the image, using the angle quantization index modulation (AQIM) method (Ourique et al., 2005).The AQIM has the advantages of QIM watermarking, but it also renders the watermark robustness to amplitude scaling attacks.In the GDWM method, the imperceptibility requirement is fulfilled by the following three mechanisms: • By embedding the watermark in the significant (i.e.large) gradient vectors, the watermark becomes less perceptible.This is due to the observation that the human visual system (HVS) is less sensitive to distortions around the significant edges (i.e.represented by the significant gradient vectors) than to distortions in smooth areas (Barni et al., 2001).• It is well known from comparing the additive with the multiplicative SS watermarking methods, that a disturbance proportional to the signal strength is more difficult to perceive (Langelaar et al., 2000).Therefore, by showing that a gradient change introduced by AQIM is proportional to the gradient magnitude, we can conclude that this method yields a less perceptible watermark.
Assume that the angle of the gradient vector is altered by Δθ.As the gradient vector g equals to r exp(iθ), it is easy to obtain the absolute gradient change |Δg| due to the angle change Δθ: where r denotes the gradient magnitude.It can be seen that the value of |Δg| is proportional to r (i.e.d ∝ r) and therefore AQIM results in a less perceptible watermark.• The change in the higher order gradient vectors is less perceptible than the change in the first order gradients.
To increase the watermark capacity, the watermark bits are embedded in gradient vectors extracted from the multiscale wavelet coefficients of the image.This is accomplished by using a multiscale wavelet transform.For example, to embed a 256-bit watermark, 128, 64 and 64 bits can be embedded in the gradient fields obtained from scales 3, 4 and 5 of the wavelet transform of the image.
The rest of this chapter is organized as follows: a brief overview of the discrete wavelet transform (DWT), multi-scale gradient estimation, quantization index modulation (QIM) and angle quantization watermarking is given in Section 2. The watermark embedding scheme, called gradient direction watermarking (GDWM) (N.Arya et al., 2011), is described in Section 3. In this scheme, the image is first mapped to the wavelet domain from which the gradient fields are obtained.The gradient field at each wavelet scale is then partitioned into blocks.
The watermark bits are embedded by changing the angles of the significant gradient vectors in each block using the AQIM method.The resultant (watermarked) wavelet coefficients of the image are computed.Finally the watermarked coefficients are inversely mapped to obtain the watermarked image.The decoding steps are discussed in Section 4, where the watermark bits are decoded following the reverse encoding steps, and the summary is given in Section 6.

Notation
In this chapter, bold lower case letters, e.g.x, and bold capital letters, e.g.X, denote vectors (or discrete signals) and matrices, respectively.The vector or matrix elements are denoted by lower case letters with an index, e.g.x i or x ij .T h ev e c t o ra tp i x e l(i, j) in the discrete vector field is represented as f i,j .

Continuous wavelet transform (CWT)
Wavelet transform decomposes a signal into shifted and scaled versions of a mother wavelet.
The continuous wavelet transform (CWT) (Mallat, 1997) of a 1-dimensional continuous signal x is defined by where ψ represents a bandpass wavelet function, called the mother wavelet, .denotes the inner product and the parameters s and u denote the scale and translation (shift), respectively.
Similarly, the 2-dimensional continuous wavelet transform (2D CWT) of a continuous image x(t 1 , t 2 ) can be defined as where u 1 and u 2 denote the horizontal and vertical shifts, respectively.

Discrete Wavelet Transform (DWT)
Since the continuous wavelet transform is highly redundant, it is more efficient to sample the continuous shift-scale plane u − s, to obtain the discrete wavelet transform (DWT).In the dyadic DWT (i.e.W j,n x), the scale and translation components, s and u, are respectively sampled at intervals of {2 j } j∈Z and {n2 j } n∈Z ,w h e r ej and n denote the discrete scale and translation parameters, respectively, and Z denotes the set of integer numbers.
The multiscale discrete wavelet transform represents a continuous signal x(t) (or a discrete signal) in terms of bandpass filters ψ j,n (t) and shifted versions of a scaled lowpass filter φ(t) (called the scaling function (Mallat, 1997)) as where a J [n] and d j [n] are called approximation and detail wavelet coefficients at scales J and j, respectively.In Eq. ( 4), the wavelets ψ j,n (t) and φ J,n (t) can be expressed as For an orthogonal DWT The approximation and detail coefficients a J [n] and d j [n], are obtained by projecting x(t) onto φ j,n (t) and ψ j,n (t) as DWT can also be extended to 2-dimensional images by decomposing the continuous image x(t 1 , t 2 ) using 2-dimensional scaling functions φ J,n 1 ,n 2 (t 1 , t 2 ) and bandpass wavelets As can be seen, at each scale j, the 2D DWT decomposes an image into 3 highpass subbands HL, LH and HH (denoted by superscript k = 1, 2, 3) and one lowpass subband LL.The approximation and detail wavelet coefficients in an orthogonal 2-dimensional DWT (2D DWT) can be obtained as The 2-dimensional (2D) wavelets φ J,n 1 ,n 2 and ψ k j,n 1 ,n 2 are usually obtained from tensor products of 1-dimensional (1D) orthogonal wavelets as where ψ 1 j,n 1 ,n 2 (t 1 , t 2 ), ψ 2 j,n 1 ,n 2 (t 1 , t 2 ) and ψ 3 j,n 1 ,n 2 (t 1 , t 2 ) are respectively the horizontal, vertical and diagonal continuous-time 2D wavelets that are shifted to the point (n 1 , n 2 ).

Multiscale gradient estimation Using 2D CWT
In this subsection, the relationship between the p-th order gradient vector of a continuous image and the 2-D wavelet coefficients is obtained.
It was shown in (Mallat & Hwang, 1992) that ψ 1 (t 1 , t 2 ) and ψ 2 (t 1 , t 2 ) with p vanishing moments can be written as where ρ(t 1 , t 2 ) is a smoothing function whose double integral is nonzero.Let ψ 1 s (t 1 , t 2 ) and ψ 2 s (t 1 , t 2 ) denote the scaled versions of ψ 1 (t 1 , t 2 ) and ψ 2 (t 1 , t 2 ), respectively, given as where s denotes the continuous wavelet scale .Using Eqs. ( 12) and ( 13), it is easy to show that the horizontal and vertical wavelet components of the 2-D image x(t 1 , t 2 ) can be obtained as where * denotes the convolution operator,and where W 1 s,u 1 ,u 2 x denotes the horizontal wavelet coefficient of x at scale s and point (u 1 , u 2 ).
Eq. ( 14) shows that the vector of wavelet coefficients W s,u 1 ,u 2 x=[W 1 s,u 1 ,u 2 x, W 2 s,u 1 ,u 2 x] T can be interpreted as the p th -order gradient vector of x * ρ s at point (u 1 , u 2 ).

Quantization Index Modulation (QIM)
To embed a watermark bit b in vector x, the QIM method quantizes x using the quantizer Q 0 (.) when b = 0a n dQ 1 (.) when b = 1.The possible values of the quantizers Q 0 (.) and Q 1 (.) belong to the lattices Λ 0 and Λ 1 , respectively: where  16) are marked by × and •, respectively.
watermarked vector x w is then obtained as the closest lattice point in Λ 0 to x when b = 0, or as the closest one in Λ 1 when b = 1.This can be expressed as At the decoder side, the value of the watermark bit b is extracted from the received vector x ′ by finding whether the nearest lattice point to the point x w belongs to

Angle quantization watermarking
As mentioned in subsection 1.2, the QIM method is fragile to amplitude scaling attacks.To address this concern, angle quantization watermarking embeds the watermark bit in the angle of the 2-dimensional vector.In angle quantization watermarking, the angle θ of vector x is assigned to a binary number 0 or 1.
In this section, we only describe the uniform angle quantization, in which the quantization circle is divided into a number of equiangular sectors in the range (−π, π], as shown in Fig. 2. Two angle quantization watermarking methods are now described:

Angle Quantization Based Watermarking Method (AQWM)
The first method we consider is the angular version of the method proposed in (Kundur & Hatzinakos, 1999).The quantization function, denoted by Q(θ), maps a real angle θ to a binary number as follows: AQIM.Vectors before and after watermarking are represented by "thick black" and "thin gray" arrows, respectively.
These rules are illustrated in Fig. 3(a) and can be formulated as: where θ w denotes the watermarked angle.

Angle Quantization Index Modulation (AQIM)
One drawback associated with AQWM is that if Q(θ) = b, the angle is not necessarily modifiedtowardthenearest sector having bit b.In other words, AQWM may change the angle more than required and this could lead to a perceptible watermark.Another drawback of AQWM is its low robustness to small angle perturbations.If the watermarked angle θ w is Fig. 4. The block diagram of the watermark embedding scheme.
close to sector boundaries, even a small amount of noise could be enough to make the angle pass the boundary and thus generate an error when the watermark bit is decoded.
To overcome these two drawbacks, the angle quantization index modulation (AQIM) method forms a possible alternative.AQIM (Ourique et al., 2005) is an extension of the QIM (Chen & Wornell, 2001) method, where the following rules are used to embed a watermark bit b into an angle θ:

The gradient watermark embedding method
The block diagram of the gradient watermark embedding strategy (N.Arya et al., 2011) is shown in Fig. 4. The embedding steps are summarized as follows: Step 1 To embed the watermark in the gradient of the image, first a domain that represents the gradient must be obtained.As shown in Eq. ( 14), the horizontal and vertical wavelet coefficients could be used to calculate the horizontal and vertical gradients of the image.Thus, based on the selected gradient order (e.g.2nd, 3rd, 4th or 5th-order gradient), the image is transformed to the wavelet domain using the corresponding wavelet (e.g.Symlet2, Symlet3, Symlet4 or Symlet5).Thus, Symlet2 is used to obtain the 2nd-order gradient, Symlet3 to obtain the 3rd-order gradient and so on.The gradient field at a certain wavelet scale is then obtained using the the wavelet coefficients at the same scale.For example, (for gradient order 3) the gradient fields of image Lena at scales 3, 4 and 5 are obtained from the wavelet coefficients (obtained using Symlet3) at corresponding scales 3, 4 and 5, as shown in Fig. 5.The wavelet-based gradient estimation is described in subsection 3.1.
Step 2 To embed the bits of the watermark, the gradient field at each scale is partitioned into blocks (see Fig. 6(a)).The number of blocks depends on the number of bits to be embedded.Thus, bits can be embedded in the gradient fields corresponding to more than one scale.
Step 3 The positions of the gradient vectors are uniformly scrambled at each scale, as illustrated in Fig. 6(b).The watermark bits are inserted into the significant gradient  vectors of each block.Significant gradient vectors are the gradient vectors with large magnitudes.Embedding the watermark bits in the significant vectors makes it robust to many attacks.As some blocks do not contain significant gradients, and as a watermark bit is inserted into each block, scrambling the locations of the significant gradient vectors is used.The scrambling used should guarantee that statistically each block contains at least one significant gradient vector.More details about the scrambling method are given in subsection 3.2.
Step 4 The significant gradient vectors of each block are calculated.
Step 5 For security reasons, the binary watermark message is scrambled using a secret key.
Step 6 In each block, one bit of the watermark is embedded in the angle of the most significant gradient vectors, using angle quantization index modulation (AQIM) (see Fig. 6(c)).It is preferred however to embed the same bit using 2 (or even more) gradient vectors.The number of the most significant gradient vectors as the bit is embedded in is denoted by BR.The AQIM method in the gradient domain is discussed in subsection 3.3.

Step 7
The correct detectability of the watermarked gradient vectors is enhanced by increasing their magnitudes relative to the nonsignificant (unwatermarked) vectors, as illustrated in Fig. 6(d).More explanations are given in subsection 3.4.
Step 8 The watermarked gradient fields at each scale are descrambled, using the descrambling method associated with the scrambling method in step 3 (cf.Fig. 6(e)).The descrambling method is explained in subsection 3.2.
Step 9 The watermarked wavelet coefficients are obtained from the watermarked gradient vectors.
Step 10 Finally, the watermarked image is obtained using the inverse wavelet transform on the watermarked wavelet coefficients.

Higher-order multiscale gradient transform
To obtain the gradient vector g j [m]=g h j [m]+ig v j [m] at pixel m =(m 1 , m 2 ) and wavelet scale j, the horizontal and vertical wavelet coefficients d 1 j [m] and d 2 j [m] are used: (21) and using Eq. ( 14) matrix A j is obtained as Based on the type of the gradient operator used to calculate the gradient vectors, other versions of matrix A j can also be used (N.Arya et al., 2011).In this chapter, the identity matrix is used to obtain the higher-order gradient vectors at each scale.This means that the horizontal and vertical wavelet coefficients are the same as the gradient vector components.

Scrambling and descrambling the gradient fields
As mentioned before, to embed the watermark bits, the gradient fields of the image are obtained.The straightforward way to embed the watermark bits is to partition the gradient fields into non-overlapping blocks and each watermark bit is then embedded into each block.
The bit is inserted into the BR most significant gradient vectors of the block, since embedding the watermark in the significant vectors makes it robust to attacks.However in natural images, the spatial distribution of the significant gradient vectors in the gradient fields is non-uniform (as some parts of the image may have all or most of the significant gradient vectors, while other parts may have no significant gradient vectors).If a bit is embedded into a block with no significant gradient vectors, then the robustness of the watermark bit to noise and other attacks is reduced.Therefore the straightforward uniform embedding may reduce the robustness of the watermark bits in the image areas with no significant gradient vectors.
To solve this problem, the locations of all gradient vectors are uniformly scrambled, so that each block contains at least one significant gradient vector.As shown in Fig. 6(c), the positions of the gradient vectors at each scale are uniformly scrambled over the gradient field.At each block, the watermark bits are inserted into the angles of significant gradient vectors, using AQIM method.The gradient vectors are then descrambled so they are located back at their original positions.

Scrambling method
The scrambling method should be a geometric transform that would ideally result in a uniform distribution of the locations of the significant gradient vectors.Different geometric image scrambling methods have been proposed.These include the Fibonacci transformation (Zou et al., 2004), Arnold Cat transformation (Ming & Xi-jian, 2006) and Gray Code transformation (Zou & Ward, 2003).It has been shown in (Xue Yang & Jia, 2010) that most of the geometric transforms are special cases of the affine modular transformation (Zou et al., 2005).Therefore, the affine modular transform is employed, due to its generality.
In a gradient field of size M × M, let the coordinate vectors of each vector in the original and scrambled gradient fields be denoted by where a, b, c, d, e and f are scrambling parameters.If the absolute value of the determinant of the matrix S =[ a, b; c, d] equals to 1 (i.e.det(S)=|ad − bc| = 1), the transform is area preserving and one-to-one mapping.For a given positive integer M,thenecessary and sufficient condition for the periodicity of the affine modular transform is that det(S) and M are primal to each other (Zou et al., 2005).

Descrambling method
By using the periodicity property of the affine modular transform, the original image can be recovered from the scrambled image.Let the smallest period of this map be denoted by t M .I f the scrambled image is constructed by applying this transformation t times, the descrambled image can be exactly recovered after consecutively applying the same transformation t M − t times (Xue Yang & Jia, 2010).To reduce the number of parameters needed in embedding and to make it an area preserving transform, the elements of the mapping matrix S are assigned the values a = 1, b = p, c = q and d = 1 + pq.The mapping matrix S is then given by

AQIM in the gradient domain
As mentioned before, to insert the watermark bits, the angles of the significant gradient vectors are changed.The amount of change Δθ in the angle is obtained by Eq. (??).To rotate a gradient vector by Δθ = θ w − θ,therotation matrix R Δθ (of size 2 × 2) is used: Thus, the watermarked gradient is obtained as

Enhancing the detectability of the watermarked gradient vectors
Attacks may change the watermark bits in one of the following ways: • The attack may result in a change in the angle of a significant gradient vector, such that the extracted bit is different from the embedded one.• The attack may result in a reduction in the magnitude of a significant gradient vector, such that the decoder can no longer identify it as a significant vector.In this case, a watermark bitisextractedfromagradientvectorthatwasnotamongsttheBRmostsignificantvectors.In the first case, to increase the watermark robustness, a larger angle quantization step size Δ is preferred.Note that the maximum step size is constrained by the imperceptibility constraint on the embedded watermark.In the second case, one solution is to enhance the detectability of the watermarked gradient vectors by increasing the magnitude r of such a vector.
Let us denote the magnitude of the gradient vector g j by r.To increase the magnitude of each watermarked vector, dr can be calculated by: where α is a constant that adjusts the overall gradient magnitude change in the image and r LIS is the magnitude of the largest insignificant gradient vector in each block.

The watermark decoding method
The block diagram of the watermark decoding method is shown in Fig. 7.The decoding steps are as follows: Step 1 Step 1 of watermark embedding process is repeated.That is the watermarked image is mapped to the gradient domain using the multiscale gradient transform, discussed in subsection 3.1.
Step 2 As in step 2 of the watermark embedding, the gradient field at each scale is partitioned into blocks.The blocks should be of the same size as those used in the embedding process.
Step 3 The positions of the gradient vectors are uniformly scrambled with the same method and parameters used in step 3 of the the embedding process.
Step 4 The significant gradient vectors of each block are detected.
Step 5 The bits of the BR most significant gradient vectors of each block are decoded, using the AQIM decoder, as discussed in subsection 2.6.If all the BR decoded bits have the same value (e.g.b), the decoded watermark bit will also be the same bit (i.e.b).In the case, the bits have different values, they are assigned weights based on the following rules: • A watermark bit extracted from a large gradient vector is given more weight than a bit extracted from a small gradient vector.• A watermark bit extracted from an angle close to the center of a sector, is given more weight than a bit extracted from an angle close to a sector boundary.Based on these two rules, each watermark bit is weighted by where BR denotes the number of watermarked significant gradient vectors in each block, γ is a constant that represents the importance of magnitude weighting vs. angle weighting.
Based on the weights determined by Eq. ( 28), the watermark bit in each block after decoding is given the value b = 1i fb w ≥ 0.5 0O t h e r w i s e (29 where b w is defined as where the function B(θ) is as defined in Eq. ( 18).
Step 6 Since the extracted watermark is the scrambled version of the original message, it should be descrambled using the same key used in the embedding process.

Example
Different pseudo-random binary watermarks of size 256 are embedded in the grayscale images Lena, Barbara, Baboon and Peppers.All the images are of size 512 × 512.To obtain the 2nd, 3rd, 4th and 5th order gradients, Symlet2, Symlet3, Symlet4 and Symlet5 wavelets are used, respectively.The Symlet wavelets are chosen because of their near-symmetrical shapes.
Irrespective of the order of the gradient used, for a 256-bit watermark, 128, 64 and 64 bits are embedded in the gradient fields at scales 3, 4 and 5 using the block sizes 4 × 8, 4 × 4and2× 2, respectively.
The parameters (p, q) for images Pappers, Baboon, Barbara and Lena are set to (3, 4), (1, 1), (2, 3) and (2, 1), respectively.The value of the parameter γ in Eq. ( 28) is set to 4. Each bit is embedded in the 2 most significant (largest) gradient vectors of each block, i.e.BR=2.The angular quantization step size Δ and the gradient magnitude enhancement coefficient α, given in Eq. ( 27), are obtained separately for each image and gradient transform.Table ??
shows the optimum values of Δ for each image.To evaluate the robustness of the scheme, each watermarked image is distorted by different types of attacks.After the attacks, each watermark is extracted and is compared with the original watermark to estimate the bit error rate (BER).The overall BER is obtained by averaging over 100 runs with 100 different pseudo-random binary watermarks.
The BER (%) results of the gradient direction watermarking (GDWM) method, under amplitude scaling, Gaussian filtering, median filtering and JPEG compression is shown in is used.For the Gaussian filtering, median filtering and JPEG compression attacks, Symlet5 (i.e. the 5th-order gradient of the image) gives the best results.
Fig. 8 presents the image Lena watermarked with the GDWM method, using Symlet2, Symlet3, Symlet4 and Symlet5 wavelets.To compare the original and watermarked images, the SSIM metric is employed due to its compatibility with the human visual system (Wang et al., 2004).As shown in Fig. 8, the GDWM method yields imperceptible watermarks at PSNR=42 dB.Based on visual inspection, Symlet4 (i.e. the gradient of order 4) gives the most imperceptible watermark.However, the best SSIM value is obtained by Symlet5 (i.e. the gradient of order 5).
Table 3 compares the BER results of the GDWM method with the method in (Wang et al., 2002) under median filtering, JPEG compression, AWGN and salt & pepper noise attacks.As in (Wang et al., 2002), the watermark length in both methods is 256 bits and the PSNR of all the watermarked test images is 42 dB.Symlet5 wavelet is used to implement the GDWM method.Table 3.The BER comparisons between the GDWM and Wang's method (Wang et al., 2002) under different types of attacks (Message length=256 bits, PSNR=42 dB) The results clearly demonstrate that the GDWM method consistently outperforms the Wang's method under all considered attacks.
In Table 4 the GDWM is compared with the non-blind method proposed in (Akhaee et al., 2010).In both methods, a 128-bit pseudo-random binary message is embedded in the images Baboon and Barbara with PSNRs 39.53 dB and 36.63 dB, respectively.To embed 128 bits, 64, 32 and 32 bits are inserted in the gradient fields at scales 3, 4 and 5, respectively.Symlet5 wavelet is used to obtain the 5th-order gradient fields.It can be seen that the GDWM method outperforms Akhaee's method (Akhaee et al., 2010) under the spatial scaling, JPEG compression and AWGN noise attacks.However, GDWM is slightly less robust under the salt & pepper noise attacks.Table 4.The BER comparison between the GDWM method and Akhaee's method (Akhaee et al., 2010) under different types of attacks (Message length=128 bits)

Conclusion
This chapter describes a gradient-based image watermarking method, called gradient direction watermarking (GDWM).In this method, the watermark bits are embedded in the angles of the gradient vectors of the image.The gradient vectors correspond to a higher-order gradient of the image.The gradient fields are obtained from the wavelet coefficients of the image at different scales.To embed the watermark bit in the gradient angle, the angle quantization index modulation (AQIM) method is used.AQIM makes the watermark both imperceptible and robust to amplitude scaling attack.
The GDWM method is tested on different real images.The experimental results show that implementing the GDWM method in the 5th-order gradient domain (obtained using using Symlet5 wavelet) yields both robust and imperceptible watermarks.It is also shown that the GDWM outperforms other watermarking methods and it is robust to a wide range of attacks.
thenθ takes the value of the angle at the center of the sector it lies in.•I f Q(θ) = b,t h e nθ takes the value of the angle at the center of one of the two adjacent sectors, whichever is closer to θ.These rules are shown in Fig.3(b).

Fig. 5 .
Fig. 5. Image Lena and its representations in the gradient domain.The Symlet3 wavelet is used to obtain the gradient vectors.

Fig. 6 .
Fig. 6.Illustration of different steps during embedding a pseudo-random binary watermark of size 8 × 8 into image Lena.A 64-bit watermark is inserted into the gradient field obtained using Symlet3 at scale 4.

Fig. 7 .
Fig. 7.The block diagram of the watermark decoding scheme.

Fig. 8 .
Fig. 8. Test image Lena watermarked using different gradient transforms in the GDWM method.In each case, a 256-bit watermark is embedded with PSNR=42dB.

Table 2 .
The BER (%) results of GDWM under different types of attacks.