w
WHAT DO THE HEAD OF HISTIAEUS’ SLAVE AND A $100 BILL HAVE IN COMMON? BOTH CONTAIN WATERMARKS. THE MUSHROOMING GROWTH OF THE WORLD WIDE WEB AND OTHER NETWORKS 
HAS PUT A NEW TWIST ON THIS AGE-OLD IDENTIFICATION TECHNIQUE: DIGITAL WATERMARKS, A WAY FOR CONTENT PROVIDERS TO PROTECT THE RIGHTS TO THEIR ONLINE MATERIAL. 

Ben Franklin, in a way, fared better than the Greek slave from the fifth century B.C. Franklin’s ghostly image appears when you hold the $100 bill to the light, leaving his foreground image no worse for wear. Histiaeus’ slave actually had his head shaved, tattooed, hair regrown and then re-shaved just so Histiaeus could send a hidden message to another Greek soldier. 
The technique of watermarking paper (rather than heads) is almost as old as paper manufacturing itself, dating back to the late Middle Ages. Its earliest use seems to have been to record the manufacturer’s trademark on the product so that authenticity could be clearly established without degrading the aesthetics and utility of the stock (see http://www.ipst.edu/amp/watermk.html). In more recent times, watermarks have also been used to certify the composition of paper, including the nature of the fibers used. These watermarks were so effective, in fact, that governments began to watermark their currencies, postage stamps, revenue stamps, etc. to thwart counterfeiting. 
The digitization of our world has expanded the concept of watermarking to include immaterial, digital impressions for use in authenticating ownership claims to online material and protecting proprietary interests. However, in principle, digital watermarks are not unlike their paper ancestors. They signify something about the token of a document or file in which they inhere. Whether the product of a Fourdrinier paper press or a discrete cosine transformation, watermarks added to presentation media serve as a guarantee of authenticity, quality, ownership and source. 
A FEW WORKING DEFINITIONS 
commercial potential of offering multimedia resources through digital networks. Since commercial interests seek to use digital networks to offer digital media for profit, they have a strong interest in protecting their ownership rights. Digital watermarking is one way to accomplish this. 
Unfortunately, so many of the terms used in discussions of watermarking are so broadly defined, orthogonal to one another, and derived from other areas that a neat-looking taxonomy of features is difficult to achieve. For one thing, digital watermarking, digital steganography, digital fingerprinting and data hiding are all related concepts. In each case, a digital signal or pattern is inserted into, onto, before or after a digital document (graphic, audio file, text document, MPEG animation, etc.). However, there are subtle differences between these techniques, as well as subtle differences over the meanings of the terms. Some working definitions follow, but bear in mind that the use of these terms falls short of orthodoxy. 
Watermarks involve the transformation of a digital artifact into another token of the same type. For example, the transformation in Figure 1 involved the addition of the circular watermark. In this sense, digital watermarking may be distinguished from digital fingerprinting — the creation of a second file (or file fragment) that “describes” the original file’s content. In terms familiar to computists, watermarking is done at the “object level” while fingerprinting is done at the “meta level.” As a simple example, the checksum field of a disk sector might be considered a primitive fingerprint of the preceding block of data. Similarly, hash algorithms produce fingerprints of files, as do digests of data 
messages. A watermark is a special case of a steganograph (versus Histiaeus’ battle plan on the head of his slave). However, it is not uncommon to find practitioners who use these terms interchangeably. 

Figure 1: Digital copy of Arabic manuscript with digital water-mark superimposed. Source: IBM’s Digital Library project (http://www.software.ibm.com/is/dig-lib/); used with permission. 

Watermarks in the general sense are object-level transformations of digital artifacts (alt: files) into tokens of themselves. Watermarks may be perceptible or imperceptible. Perceptible watermarks, like the visible watermark in Figure 1, serve primarily as a statement of ownership, authorship or source. Imperceptible watermarks are used for more sophisticated applications of document identification in situations where the watermarked object must appear unaltered, at least up to 
some viewing threshold. 
Watermarks may also be robust or fragile according to whether they withstand, or fail to withstand, standard digital editing techniques without noticeably altering or degrading the original artifact. For example, invisible watermarks that are imperceptible under normal viewing, and that survive basic image modifications, would be classified as at least persistent if not robust. Watermarks (cf. Figure 1) that could be edited out of the artifact would be said to be fragile, etc. 
Finally, robust watermarks may use encryption, either public- or private-key. Under popular usage on a network, encryption transforms a source file into another form in such a way that the source becomes unusable without an appropriate peruser and the decryption key. However, in the case of watermarking, the encryption is embedded into 
an artifact that remains fully usable. 
PERCEPTIBLE VS. IMPERCEPTIBLE WATERMARKS 
Of the classification schemes that apply to watermarks, the distinction between perceptible and imperceptible seems to be the most fundamental. This distinction cuts across media types while at the same time constraining the ultimate use of the watermark technology. For example, visible watermarks, as perceptible watermarks, are used in much the same way as their paper ancestors — to identify the source or ownership of a document. Invisible watermarks, as imperceptible watermarks, on the other hand are like “magic ink” 
The distinction between perceptible and imperceptible watermarks is the most fundamental. 

Figure 2a: (left) Watermark with contrasting colors — highly visible.  Figure 2b: (right) Watermark with complementing colors that tend to blend into the background. 
— they “hide” information in documents. This impacts the range of suitability of these two categories of watermarks. 
The image in Figure 1 illustrates the technique of visible watermarking. The circular watermark is clearly seen around the left part of the image. In the right-most part of the image, the watermark tends to “hide” in the busiest part of the image. The process of hiding watermarks is illustrated in Figures 2a and 2b. In Figure 2a, the color of the star-shaped watermark easily contrasts with the color of the image, whereas in Figure 2b the watermark’s color tends to blend into the image. 
Figure 2b also illustrates the point that the terms “perceptible” and “imperceptible,” while distinct, are not dichotomous — there is no precise point at which one becomes the other. Rather, (im)perceptible represents a continuum delimited by a variety of thresholds. 
THE PURPOSE OF DIGITAL WATERMARKS 
The type of watermark influences the effectiveness of the watermark itself in various network applications. For example, both perceptible and imperceptible watermarks can deter theft, but they do so in very different ways. Perceptible watermarks are especially useful for conveying an immediate claim of ownership. 
The main advantage of perceptible watermarks, in principle at least, is that they virtually eliminate the commercial value of a document or media object without significantly lessening the document’s utility for legitimate, authorized purposes. That is to say, the watermark in Figure 1 makes it clear that the document belongs to someone, but it does this without preventing the appreciation of the artifact. A familiar example of a visible watermark is in the video domain, where CNN and other television networks place their translucent logo at the bottom right of the screen image. 
Imperceptible watermarks, on the other hand, are only effective as a theft deterrent if the potential thief has a reason to believe that watermarks might be present, and further that they may be used to prosecute unauthorized possessions. If we assume that the majority of potential thieves are at best computationally challenged, an imperceptible watermark would be very ineffective. However, though weak in terms of discouraging theft, imperceptible watermarks really shine as a means of identifying the source, version or serial number, author, creator, owner, distributor or authorized consumer of a document or image. For this purpose, the objective is to permanently and unalterably 
mark the image so that the credit or assignment is beyond dispute. In the event of illicit usage, the watermark would facilitate the claim of ownership, the receipt of copyright revenues or the success of prosecution. 

In some cases, both watermarking schemes are equally effective. For example, both may be used to determine the location, and trace image migration, of documents over the network. Several computing companies (such as those listed in the sidebar “Watermarking’s URL Pearls”) are developing software to deploy watermark agents in network “patrols” to detect infringement. It should be remembered that watermarking software can assign a unique watermark to each document or object for each authorized user or consumer. 
Though neither exhaustive nor definitive, Table 1 shows some primary and secondary 
benefits of digital watermarking. 
THE WATERMARK “LITMUS TEST” 
The litmus test for watermarks includes the qualities of persistence, robustness and unobtrusiveness as explained below: 
Persistence — watermarks must persist under common image modifications (e.g., scaling, color requantization, dithering, filtering, cropping and image compression). 
Robustness — watermarks must resist digital attacks to delete, modify or “bury” the watermark in another, illicit one. Ideally, robustness also entails authorized, legitimate recoverability of the watermark and the signature used to create it despite intervening editing. Ideal robustness, in this sense, has proved to be illusive. 

TABLE 1: BENEFITS OF DIGITAL WATERMARKING 
Note: P = primary; S = secondary PURPOSE PERCEPTIBLE IMPERCEPTIBLE 
Determine ownership PP Validation of intended recipient — P Non-repudiable transmission — P Deterrence against theft PP* Meta-level content labeling — P Diminish commercial value without utility P — Discourage unauthorized duplication PP* Authentication SP Identify document source PP Network patrolling (e.g., on Web) SP Rights management (e.g., “copies remaining”) SP 
*With caveats 
Perceptible and imperceptible watermarks act as a deterrent to theft in different ways. Perceptible watermarks diminish the commercial value of the document or image; imperceptible watermarks increase the likelihood of successful prosecution and may also act as a deterrent if the criminal is sufficiently computer literate. 

Spatial watermarking helps journalists verify digital stock photos. 

✤ 	Unobtrusiveness — both perceptible and imperceptible watermarks should be sufficiently unobtrusive so that they do not prevent the use and appreciation of the watermarked object for the intended purposes. 

To these qualities, we might also add for the sake of law enforcement: 

✤ 	Decodability — for some invisible watermarking applications, watermarks should be readily detectable by the proper authorities, even if imperceptible to the average observer. Such decodability without requiring the original, un-watermarked image would be necessary for efficient recovery of property and subsequent prosecution. 

WATERMARKING TECHNIQUES 
Although in principle digital watermarks may be embedded in any digital medium, by far most published research on watermarking to this point deals with graphics images and text. We’ll restrict our attention to these two categories. 
Robust image watermarking commonly takes on two forms: spatial domain and frequency domain. One spatial domain watermarking technique slightly modifies the pixels in one of two randomly selected subsets of an image. Modification might include flipping the low-order bit of each pixel representation. It is easy to see how this would have little perceptible effect on the image when viewed with the common 24-bit color gamuts used today in monitors of generic home/office computers. Of course, this will work well only if the image is not subject to any human or “noisy” modification, but it does seem to hold up well under lossy image compression and selected filtering techniques. 
Spatial watermarking can also be applied using color separation so that the watermark appears in only one of the color bands. This renders the watermark sufficiently subtle that it can be for all intents and purposes imper
ceptible. However, the watermark appears immediately when the colors are separated for printing. This renders the document useless to the printer unless the watermark can be removed from the color band. This approach is used commercially for journalists to inspect digital pictures from a stock-photo house before buying un-watermarked versions. 
Watermarking can also be applied in the transform domain, including such transforms as Fast Fourier, discrete cosine and wavelet. In the case of frequency transforms, the values of chosen frequencies can be altered from the original. Since high frequencies will be lost by compression or scaling, the watermark signal is applied to lower frequencies or, better yet, applied adaptively to frequencies that contain important information of the original picture (feature-based schemes). 
Since watermarks applied to the frequency domain will be dispersed over the entirety of the spatial image upon inverse transformation, this method is not as susceptible to defeat by cropping as the spatial technique. However, there is more of a trade-off here between invisibility and decodability, since the watermark is in effect applied indiscriminately across the spatial image. Other transform domain techniques have their own particular characteristics with respect to the litmus test above. 
Watermarking can be applied to text images as well. Three proposed methods are text-line coding, word-space coding and character encoding. For text-line coding, the text lines of a document page are shifted imperceptibly up or down (see Figures 3a-c). For a 40-line text page, for instance, this yields 240 possible code words. For word-space coding, the spacing between words in a line of justified text is altered. Of course, the watermark can be defeated by retyping the text. 
LIMITATIONS OF DIGITAL WATERMARKING 
In 1997, a counterfeiting scheme was demon-
strated for a class of invertible, feature-based, frequency-domain, invisible watermarking algorithms. This counterfeiting scheme could be used to subvert ownership claims because the recovery of the digital signature from a watermarked image requires a comparison with an original. The counterfeiting scheme works by first creating a counterfeit watermarked copy from the genuine watermarked copy by effectively inverting the genuine watermark. This inversion creates a counterfeit of the original image that satisfies two properties: A comparison of the decoded versions of both the original and counterfeit original yields the owner’s (authorized) signature; and a comparison of decoded versions of both the original and counterfeit original yield the forged (inverted) signature. 

Thus, the technique of establishing legitimate ownership by comparing a watermarked image with the original image breaks down. It can be shown that both the legitimate signature and counterfeiter’s signature inhere in both the watermarked and counterfeit watermarked copies. Thus, while it may be demonstrated that at least one recipient has a counterfeit watermarked copy, it cannot be determined which one it is. 
This research suggests that not all water
marking techniques will be useful in resolving ownership disputes in courts of law. There will likely be non-commercial applications, or those with limited vulnerability to theft, where “good-enough watermarking” will suffice. More sensitive applications may require non-invertible or non-extracting watermarking techniques. 
THE FUTURE OF WATERMARKING 
Though digital watermarking of various types has been around since the early 1990s, the remaining open questions seem to be in a continuous-growth mode. Until recently, we thought the important questions were whether perceptible or imperceptible watermarks had the greatest applicability, how one might define an acceptable threshold of imperceptibility, whether original images should be required for decoding, and how watermarks would be policed. 
Even though many of these questions are still unanswered or only partially answered, we need to add a raft of new questions to the list. How might one characterize “goodenough watermarking,” perhaps akin to Phil Zimmerman’s Pretty Good Privacy, for widespread use on the Internet and Web and for a wide variety of commercial and non-com-

Figures 3a, 3b, 3c: Text-line watermarking. The first and third lines of the original text in Figure 3a are lowered by 1 pixel in Figure 3b (effectively imprinting a code that begins with “101” into the document). The change is highlighted in Figure 3c. 

mercial applications? What constitutes “reasonable” levels of persistence and robustness? What type of attacks must be anticipated, and how significant are they across application domains? Should watermarks be decodable without comparison to the original document? 
Therein lies the challenge to computer scientists and software vendors to develop digital watermarks that are every bit as reliable as their paper predecessors. The viability of networked digital content may well depend on 
their results. Hopefully, no heads will need to be shaved in the process. 
AFTERWORD 
For an early look at watermarking techniques, see “Protecting Ownership Rights Through Digital Watermarks,” IEEE Computer, 29:7 (1996), pp. 101-103. More recently, the special section of Communications of the ACM on digital watermarking (41:7, July 1998, pp. 31-77) contains a multitude of useful watermarking references. 
~ 
WATERMARKING’S URL PEARLS 
SELECTED VENDORS 
Aliroo: http://www.aliroo.com Blue Spike: http://www.bluespike.com/ Datamark: http://www.datamark.co.uk/brief.html Dice: http://www.digital-watermark.com/ Digimarc: http://www.digimarc.com/ EIKONAmark: http://www.generation.net/~pitas/sign. 
html FileNet: http://www.filenet.com/prods/watermark/ IBM: http://www.research.ibm.com/image_apps/index. 
html; also see http://www.ibm.com/IBM/ibmgives/ 
diglib.htm JK_PGS: http://ltswww.epfl.ch/~kutter/watermarking/JK_PGS. html 
Signafy: http://www.princetoninfo.com/signafy.html Signum: http://www.signumtech.com/ SysCoP: http://syscop.igd.fhg.de/; http://www.mediasec. 
com/products/index.html Talisman: http://ns1.tele.ucl.ac.be./TALISMAN 
ONLINE REFERENCES 
Patents 
http://www.patents.ibm.com/ 
Bibliographies 
http://www.comm.toronto.edu/~deepa/wtmk.html 
http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ readers-guide/journals.html http://cosimo.die.unifi.it/~piva/Watermarking/ 
Topical References 
3-D watermarking: http://www.trl.ibm.co.jp/projects/s7340/ embed/idms/idms.htm 
Watermarking in the “real world”: http://gs207.sp.cs.cmu. edu/~adrian/wmark-realworld/ 
“Artificial” watermarks: http://www.pummill.com/ artificial_watermarks.htm 
Testing: http://www.cl.cam.ac.uk/~fapp2/watermarking/ image_watermarking/stirmark/ 
General References 
http://www.netscapeworld.com/nw-03-1997/nw-03
watermark.html http://www.acm.org/~hlb/col-edit/digital_village/nov_97/ dv_11-97.html 
http://www.pcwebopedia.com/digital_watermark.htm http://diva.eecs.berkeley.edu/~linnartz/water.html http://www.datamark.co.uk/brief.html 
PERMISSION TO MAKE DIGITAL OR HARD COPIES OF ALL OR PART OF THIS WORK FOR PERSONAL OR CLASSROOM USE IS GRANTED WITHOUT FEE PROVIDED THAT COPIES ARE NOT MADE OR DISTRIBUTED FOR PROFIT OR COMMERCIAL ADVANTAGE AND THAT COPIES BEAR THIS NOTICE AND THE FULL CITATION ON THE FIRST PAGE. TO COPY OTHERWISE, TO REPUBLISH, TO POST ON SERVERS OR TO REDISTRIBUTE TO LISTS, REQUIRES PRIOR SPECIFIC PERMISSION AND/OR A FEE. © ACM 1091-3556/98/0900 $5.00 
䘀椀最甀爀攀 ㄀㨀 䐀椀最椀琀愀氀 挀漀瀀礀 漀昀 䄀爀愀戀椀挀 洀愀渀甀猀挀爀椀瀀琀 眀椀琀栀 搀椀最椀琀愀氀 眀愀琀攀爀ⴀ洀愀爀欀 猀甀瀀攀爀椀洀瀀漀猀攀搀⸀ 匀漀甀爀挀攀㨀 䤀䈀䴀ᤠ猀 䐀椀最椀琀愀氀 䰀椀戀爀愀爀礀 瀀爀漀樀攀挀琀 ⠀栀琀琀瀀㨀⼀⼀眀眀眀⸀猀漀昀琀眀愀爀攀⸀椀戀洀⸀挀漀洀⼀椀猀⼀搀椀最ⴀ氀椀戀⼀⤀㬀 甀猀攀搀 眀椀琀栀 瀀攀爀洀椀猀猀椀漀渀⸀