【正文】 tal watermarks also offer forgery detection. Several watermarking techniques have been proposed. One uses a checksum on the image data which is embedded in the least significant bits of certain pixels. Others add a maximal length linear shift register sequence to the pixel data and identify the watermark by puting the spatial cross correlation function of the sequence and the watermarked image. Watermarks can be image dependent, using independent visual channels, or be generated by modulating JPEG coefficients. These watermarks are designed to be invisible, or to blend in with natural camera or scanner noise. Visible watermarks also exist。 IBM has developed a proprietary visible watermark to protect images that are part of the digital Vatican library project. In this paper we present a watermark which is a twodimensional extension of. We describe a forgery detection scheme with a new approach to robustness. The watermark39。s robustness to mean and median filtering is investigated. We then introduce a second watermark that is robust relative to JPEG pression.2. ADDITION OF MSEQUENCESA linear feedback shift register with n stages can form pseudorandom binary sequences with periods as large as 2n 1。 msequences achieve this maximum period and have excellent randomness and autocorrelation properties. To generate the watermark, a binary sequence is mapped from {0, 1} to {1, 1}, arranged into a suitable block, and then added to the image pixel values. Advantages of this type of watermark include:1. If an authorized user knows the watermark, the exact original image can be obtained. The LSB plane is not irrecoverably altered as it is with a checksum technique.2. An attacker can only swap pixels with the same msequence bit without affecting the correlation properties. This requires knowledge of the private embedded sequence to successfully forge any reasonable area of the image.3. Multiple watermarks can overlap each other and will not change the average value (brightness) of the image. Successive watermarks would treat the previously watermarked image as the original. This would also trace an image39。s chain of custody or audit history.Some disadvantages include:1. If the watermark covers the entire image, an attacker must merely guess if a given pixel has increased or decreased by one gray level to identify a particular bit in the watermark.2. An attacker could pute an entire watermark block if 2n consecutive bits are known. More secure non linear codes, such as the Gold or Kasami codes, address this problem.3. This method does not specifically protect the DC value of the pixels covered by an individual block.The watermark consists of extended msequences of length 512 bits added to each pixel in a row of the image. Extended msequences are msequences of order n, with a 0 inserted at the end of the n 1 run of zeros. The phase of the extended msequence carries the watermark information. The testing procedure filters the cross correlation function of the possibly forged, watermarked image row and the extended msequence. If a suitably large cross correlation peak is found, the row passes the watermark test.Our watermark uses a much longer msequence, which is arranged row by row into a twodimensional block. We append a 0 to the entire msequence, instead of using an extended msequence. Enough blocks are concatenated to cover the entire image. One advantage of a twodimensional watermark is the ability to more effectively locate where an image has been changed. Forgeries made to only a small portion of the image would affect the respective block and not the entire row of the image. Our testing algorithm simply overlays the watermarked image block and the watermark block, putes an inner product, and pares the result to the ideal value. If the difference relative to the ideal value is larger than a defined threshold, the block fails the watermark test. This forgery detection algorithm eliminates the need to pute an entire cross correlation function. The details of this are described below. One must perform several operations on each block of pixels in the image to test the new watermark. We first define the spatial cross correlation function of images X and Y as:RXY (225。, 226。) = ∑ ∑ X (i, j ) Y (i ? 225。, j ? 226。 ) (1) Let X be the original image block, W be the watermark block, Y be the watermarked image block and Z be the watermarked image block that might be forged. The test statistic for the block, is defined as: (2)If the watermarked image is unchanged, = 0. Note that does not depend on the entire cross correlation function. When is larger than a defined tolerance。 the block fails the watermark test. A larger threshold provides more robustness, but increases the probability of missing a forgery. A threshold can be defined relative to the number of elements in the watermark block.3. RESULTS OF FILTERINGOne question that needs to be addressed is how robust is the watermark to typical image processing operations. The first experiment examines the effect of mean and median filtering on forgery detection. The test image consists of a 768 x 512 pixel grayscale image. The watermark block size was chosen to be 256 x 256 pixels. An msequence with a period of 65,535 with a single zero bits appended to the end of the sequence was used. It was segmented into 256 bit sections, then arranged row by row to form the watermark block. A 3 x 2 array of these blocks formed the watermark, which covered the entire image. Three different window sizes for each type of filter were applied to two regions in the image. The goal was to see if the watermark could be used to detect these alterations to the image.The watermark test is able to detect every case of filtering. If the threshold f