A Content-Based Semi-Fragile Mesh Watermarking Scheme

Abstract

- A semi-fragile watermarking scheme based on vertex geometry is presented for 3D model authentication. Watermark is generated from 3D model and random number generator by a seed number. To embed and extract watermark, it only needs the seed number with some simple arithmetic operations. Our method is robust to general 3D model processes, such as uniform scaling, translation, and vertex reordering. The watermark embedding has little impact to the original 3D models that PSNR values can be up to nineties. Thus the proposed method is very suitable for precision instruments or medical science models. Experiments also demonstrate that the method is time and performance satisfactory.

Keywords: Semi-fragile, Watermark, 3D model

1. Introduction

In recent years the applications involving digital 3D data, such like 3D games, 3D tourism maps, 3D medical imaging, etc., are rapidly increasing in number and many efforts to obtain these models by direct acquiring or modeling have been deployed. One of reasons that make 3D models popular is that users can zoom in/out, enlarge and/or translate models to study the interested details. Due to the fact of easy duplication and modification of digital contents, it is necessary to develop a variety of watermarking techniques for various protection purposes such as ownership claiming and authentication. In this study, a watermarking scheme is proposed that it not only can ensure the integrity of 3D models but can resist common processes with little impact on appearance of models.

According to purposes, watermarking can be robust or fragile. Robust watermarking schemes are mainly for ownership assertion. As the name suggested, these methods should be immune from malicious or non-malicious attacks. There are studies in [1]-[7] focusing on robust watermarking for 3D models. [1] claims that the method can resist vertex reordering, noise, smoothing, rotation,

simplification, cropping, and combination of above mentioned attacks. [5] reports to resist simplification, noise and cropping attacks. [6] claims to resist translation, rotation and the three attacks mentioned in [5]. These papers presented experiments to support their claims without detailed explanations on how experiments were simulated. Contrary to robustness, fragile watermarking is designed to detect any modification on protected data. There are applications that rigorous data information is very important, such like 3D models for auto parts or medical science, which slight changes in the appearances may lead to unacceptable parts or medical misjudgments. Therefore, those models should be watermarked for verifying the data integrity. Semi-fragile watermarking methods are robust to common processes (non-malicious) but sensitive to malicious attacks. Sometimes, it is difficult to distinguish methods between fragile ones and semi-fragile ones since methods may resist one common process only but not the others. [8]-[12] focus on fragile or semi-fragile watermarking studies. In general, for 3D models, uniform scaling, rotation, etc., are non-malicious attacks and smoothing, simplification, cropping, etc., are malicious attacks.

This paper is organized in the following. In Section 2, related works on 3D watermarking are discussed. In Section 3, the proposed method will be explained. Experiments and analysis are provided in Section 4, and, finally, conclusions and future works are given.

2. Related Works

Some robust watermarking methods, such like [1], [5]-[7], would perform registration and/or resampling before extracting watermarks. Registration can recover the original geometric information (location and size). By this way, these methods are robust to translation, rotation, (uniform & non-uniform) scaling, and other geometric attacks. Resampling can make models into a fixed form. Consequently, theses methods can resist simplification, cropping, vertex reordering, and

Shwu-Huey Yen,Yu-Ying Chen, and Hwei-Jen Lin

PRIA Lab., CSIE Department, Tamkang University

[email protected], [email protected], [email protected]

other topological attacks. Although these kinds of processes can enhance the algorithms but they usually need the information of original models and are computation expensive.

In 1999, Yeo et al. [8] proposed the first fragile watermarking scheme for 3D models. They use two hash functions and slightly perturbed the positions of vertices to embed watermarks. The method has two problems: convergence and causality. Since then, improved semi-fragile or fragile methods were proposed to solve these problems. As in [11], mesh parameterization is used to transform vertices into 2D plane and then vertex coordinates are modified to embed watermark. Their method solves the causality but may have loopholes causing detection errors. Chou et al. [9] later proposed a fragile watermarking method as an improved of [8] and [11]. They use multi-function vertex embedding to solve causality and adjusting vertex so that the impact of embedding watermarks to models is limited.

Unlike still images, video sequences, or audio, 3D models lack a structural ordering relation among vertices. Therefore, most of schemes would use some way to order vertices and perform embedding process. Following the same ordering, the watermark can be extracted later. This ordering should be invariant to common models processes. One solution to this problem is by transforming 3D points into another coordinate system that has a structural ordering. In [8], it first evaluates the center of gravity of the model then projects all points into a 2D image. The method in [11] applies cylindrical coordinates to project all vertices to the X-axis. In [9], it uses X-coord. of vertices to find out all “marked” vertices, then uses Y, Z coordinates of those “marked” vertices as embedded features. The method in [3] translates coordinates of vertices to have gravity of the 3D model located in the center of Cartesian space. In [2] and [12], they transform all vertices into spherical coordinates.

3. Proposed Scheme

As the goal of protecting the integrity of digital content and robust to common processes, a semi-fragile watermarking scheme is proposed and explained in the following.

3.1. Watermark generating and embedding

To obtain a structural ordering relation among vertices, 3D vertices are projected on XY-plane. Consider a 3D model O ={P,C}, where P={pi=(xi,

yi, zi), i= 1,…,N} is the vertex set, and C is the connectivity relationship (face) on O. Watermark

embedding and generating process are depicted in five steps.

(1). Calculating the XY-plane centroid

G

_XY and sorting all points of the 3D model.

By projecting all points of the model on XY-plane, the centroid is obtained from Eq.(1). For point pi, the distance Di is calculated by Eq. (2). Then, points on the 3D model are rearranged in ascending order according to distances Di.

(1) 1 ) ( where ) , ( 1

∑

= = = N i i XY p N z , y , x y x G (2) ) ( ) (_{x x} 2 _{y y} 2 Di= i − + i−

(2). Dividing sorted points into H sections.

Sorted points are divided into H sections for different watermarks embedding where H=⎡N/k1⎤.

Since statistics from points within one section are used for embedding/extracting, small k1 makes

statistics vulnerable to outliers and large k1 makes

statistics insensitive to small variations. Besides, any section with points less than k2 will be merged

to one of its neighboring section that has fewer points. In our experiment, k1 and k2 are chosen as

100 and 75 heuristically. To be robust to reordering attack, points of the same distance are adjusted to be in the same section.

There are two ways to divide points into sections: equal section width and equal number of points. The former, each section covers the same width, may have sections with few or many points, and the latter, each section has the same number of points, may have sections with very narrow or very wide ranges. We adopt the combination of these two methods with a weight α as in Eq.(3). To divide into H sections, each of these two methods produces H-1 thresholds, ) 1 ( 1 11,...,t H− t and ) 1 ( 2 21,...,t H− t ,

let ti be the final threshold, then

(3) 1 -1 , )] 1 ( [ ) (t1 t2 i H ti = i∗α + i∗ −α ≤ ≤

with t0=min{Di} & tH=max{Di}, i=1,2,…, N, point

pi is in section k (≥ 2) if t_k−1<D_i≤t_k, or k=1 if

1

0 D t

t ≤ i≤ . In our experiment, α =0.5.

(3). Watermark generating and embedding for each section.

After all the points are reordered and divided into H sections, the watermarks for section k will be generated and embedded, k = 1, 2, …, H:

z With a meaningful number as the seed number, such as the owner's ID number, a decimal digit sequence of length 3H is generated by random number generator. The three digits d1, d2, d3

to be composed into 4-digit watermarks for section k in the next step.

z Consider points in section k, we first normalize Z-coord. of these points to be zero mean and unit variance by Eq.(4)-(6). Further divide the section into three subsections by the ratio of 3:4:3. Upon each subsection, extract 4-digit numbers from the 4th to 7th decimal places of normalized Z-coord. of every point. For example, 3368 is extracted from 1.392336821. Let d01, d02, d03 be the thousands place of the

average of these 4-digit numbers from three subsections. The watermarks wk1= d01d1d2d3,

wk2= d02d1d2d3, wk3= d03d1d2d3 are consequently

generated for three subsections of the section k. z For each point p in the subsection i of section k, the 4-digit watermark wki is to be embedded into

p’s normalized Z-coord.. Embedding is simply to replace the 4th to 7th decimal places of normalized Z-coord. of p by wki. (4) , 1 0 k N i i k z N k

∑

− = = μ (5) , ) ( 1 0 2 k N i k i k z N k

∑

− = − = μ σ (6) . σ μ z z' k k i i − =

Take Aardvark as an example, |P|=264, |C|=500, and ⎡N/k1⎤=⎡264/100⎤=3. After merging &

adjusting, Aardvark is divided into H=2 sections. Using a random number generator with a seed number, a decimal digit sequence of size 3H = 6 is generated, say, 346130, where 346 is for section 1 and 130 is for section 2. As for k=1, the normalized Z-coord. of points are divided into three subsections. And the average of those extracted 4-digit numbers are 4548.7, 4487.1, and 4439. Thus d01= 4, d02 = 4 and d03 =

4. With the corresponding three digits d1d2d3 =

346, the watermarks are wk1= wk2= wk3 =4346. Table 1 shows the embedding result where the 4th to 7th decimal places of normalized Z-coord. now is replaced by the watermark.

(4). Compensation.

Let z_i,z_i′,z_i′′ be the Z-coord. of point pi original, after normalized, and after watermarked. Now

i

z ′′ should be reversed by Eq.(7) to obtain the watermarked model whereμk and σk are (4), (5).

(7) . ˆi zi k k z = ′⋅′σ +μ

Unlikez′ , the distribution of z ′′ is neither zero mean nor unit variance anymore. Since keeping the watermarked zˆ as similar to the original z as

possible is essential to correctly extract the watermarks later, thus, 10% of points from the top and bottom in section k are chosen respectively to makez ′′ to be zero mean. Let μk,embedded be the average ofz ′′ in the section k of total Nk points and

m= ⎣ Nk ⋅10%⎦ the number of points that is 10% of points in section k, then for i=1, 2, …, Nk,

(8) , , ⎩ ⎨ ⎧ − ≤ < ′′ − > ≤ − ′′ = ′′′ m N i m z m N i or m i if z z k i k i i δ

where δ = (μk,embedded ⋅Nk)/2m. Table 2 is the compensation result of Aardvark for section one which has 130 points. The shaded cells are compensated vertices (m=13). As in the table, the average ofz ′′ , μk,embedded, is 4.04738 E-5, and, after compensation, the average ofz ′′′ is -8.54018 E-18. (5). Obtaining the watermarked model.

Substitutingz ′′′ for z ′′ in Eq.(7) to reverse the normalization process as in (9), the watermarked model is obtained. (9) . ˆ_i z_{i k k} z = ′′′∗σ +μ

Table 1. Watermark embedding for Aardvark (k=1)

-1.0794346 -1.079737113 -1.0534346 -1.053622665 -0.2284346 -0.228395906 -1.0934346 -1.093030034 1.0864346 1.086404156 0.1934346 0.193003867 . . . . . . . . . . . . . . . . . . 1.1394346 1.139541688 1.1434346 1.143205366 0.9594346 0.959102973 1.7114346 1.711527886 -0.7284346 -0.728431516 0.7044346 0.704162146 -1.2734346 -1.27325839 -1.6294346 -1.629717863 -0.7314346 -0.731558005 . . . . . . . . . . . . . . . . . . 0.1054346 0.105422598 -0.7864346 -0.786558529 -1.3754346 -1.375404624 -0.0414346 -0.04158463 0.7384346 0.738737695 1.3924346 1.392336821 z'' z' z'' z' z'' z' Embedding Normalization Embedding Normalization Embedding Normalization 3th_-subsection 2th_-subsection 1th_-subsection

3D model – Aardvark watermark embedding

-1.0794346 -1.079737113 -1.0534346 -1.053622665 -0.2284346 -0.228395906 -1.0934346 -1.093030034 1.0864346 1.086404156 0.1934346 0.193003867 . . . . . . . . . . . . . . . . . . 1.1394346 1.139541688 1.1434346 1.143205366 0.9594346 0.959102973 1.7114346 1.711527886 -0.7284346 -0.728431516 0.7044346 0.704162146 -1.2734346 -1.27325839 -1.6294346 -1.629717863 -0.7314346 -0.731558005 . . . . . . . . . . . . . . . . . . 0.1054346 0.105422598 -0.7864346 -0.786558529 -1.3754346 -1.375404624 -0.0414346 -0.04158463 0.7384346 0.738737695 1.3924346 1.392336821 z'' z' z'' z' z'' z' Embedding Normalization Embedding Normalization Embedding Normalization 3th_-subsection 2th_-subsection 1th_-subsection

3D model – Aardvark watermark embedding

Table 2. The compensation for Aardvark (k=1)

Average of z’’：0.0000404738 Average of z’’’：-8.54018E-18

-1.079636969 -1.0794346 -1.0534346 -1.0534346 -0.2284346 -0.2284346 -1.093636969 -1.0934346 . . . . . . . . . . . . -0.762636969 -0.7624346 0.8614346 0.8614346 -0.9034346 -0.9034346 -1.652636969 -1.6524346 0.8644346 0.8644346 0.9124346 0.9124346 0.797232231 0.7974346 . . . . . . . . . . . . . . . . . . -0.4984346 -0.4984346 -0.017636969 -0.0174346 -1.1624346 -1.1624346 0.9604346 0.9604346 -0.917636969 -0.9174346 -1.0474346 -1.0474346 -0.9974346 -0.9974346 0.935232231 0.9354346 . . . . . . -0.7864346 -0.7864346 -1.375636969 -1.3754346 -0.0414346 -0.0414346 0.7384346 0.7384346 1.392232231 1.3924346 z''' z'' z''' z'' z''' z'' 3th_-subsection 2th_-subsection 1th_-subsection

3D model - the compensation result of Aardvark

Average of z’’：0.0000404738 Average of z’’’：-8.54018E-18

-1.079636969 -1.0794346 -1.0534346 -1.0534346 -0.2284346 -0.2284346 -1.093636969 -1.0934346 . . . . . . . . . . . . -0.762636969 -0.7624346 0.8614346 0.8614346 -0.9034346 -0.9034346 -1.652636969 -1.6524346 0.8644346 0.8644346 0.9124346 0.9124346 0.797232231 0.7974346 . . . . . . . . . . . . . . . . . . -0.4984346 -0.4984346 -0.017636969 -0.0174346 -1.1624346 -1.1624346 0.9604346 0.9604346 -0.917636969 -0.9174346 -1.0474346 -1.0474346 -0.9974346 -0.9974346 0.935232231 0.9354346 . . . . . . -0.7864346 -0.7864346 -1.375636969 -1.3754346 -0.0414346 -0.0414346 0.7384346 0.7384346 1.392232231 1.3924346 z''' z'' z''' z'' z''' z'' 3th_-subsection 2th_-subsection 1th_-subsection

3.2. Watermark extracting

The extracting process is similar to the embedding process. When an authorized user receives a watermarked model with information of the seed number, he follows the steps 1, 2 in the embedding phase to divide points into H sections. For each section k, three 4-digit watermarks wk1, wk2,

wk3 (hypothetic watermarks) are generated as in step 3. The extracted watermarks are from the 4th to 7th decimal places of normalized Z-coord.. Let wi and wˆ_i be the hypothetic and extracted 4-digit watermarks corresponding to point pi. Theoretically, these two values should be very similar if the watermarked model is not attacked. Therefore, by observing the differences of wi andwˆ_i we can determine whether the model is attacked. Since the calculations described above are floating-point operations, it is common that the results have small errors on decimals and possibly cause differences in carrying digits. Thus, if di is the difference of wi andwˆ_ifor point pi, then

(10) . |) ˆ | 10000 |, ˆ min(| i i i i i w w w w d = − − −

Let d , average of all d_k i, be the extracted result for section k. Whend is less than or equal to the _k threshold, we conclude that points in section k are authentic. Note that those compensated points are ignored in evaluating _{d since they have no k} watermark information anymore. Table 3 shows the extracted result for k=1. The first two columns are the hypothetic

w

_iand the extracted

wˆ

_i; the last column is di. Finally, d₁is 40.3.

4. Experiments and Discussions

43 models from simple (Ball, |P|=34 & |C|=64; Tree, |P|=56 & |C|=104) to complicated (Horse, |P|=19,851 & |C|=39,698; Bunny, |P|=35,947 & |C|=69,451) are tested on the proposed scheme.

4.1. The perceptual quality and validity

In table 4, we show original and watermarked models, and extracted results of both for Bunny

(H=290), Horse (H=172), Dog (H=11). For

perceptual quality, before and after watermarking of the model are compared. Apparently there is no difference visually. For validity, the extracted results d from un-watermarked models, in blue, _k and watermarked models, in pink, are shown in the table. Figures in horizontal axis are number of points in section 1, 2, …, H, and vertical axis shows the average difference on that section, i.e., _dkfor section k. We can easily distinguish whether the model is watermarked from the distributions of these two lines.

When extracting watermarks from an un-watermarked model, the extracted

wˆ

_i, the 4th to 7th decimal places of normalized Z-coord., is a random value among 0000 to 9999. From uniform distribution, μ (mean) and σ (standard deviation) are about 5000 and 2887. Although the first digit of the hypothetic watermark

w

_iis from the average of the 4-digit numbers on normalized Z-coord., many first digits in

w

_iand

wˆ

_iare still different due to a very high standard deviation. Thus, we can assume d_i in (10) is approximately distributed uniformly in 0 ~ 5000 with μ ≈2500 and σ≈1444. By Central Limit Theorem, d_k is approximately Gaussian with μ ≈2500 and σ≈1444/√Nk. We can see that the average differences for those blue lines are around 2500 conforming to the analysis. On the other hand, when extracting watermarks from a watermarked model, most of first digits in

w

_i and

wˆ

_i are the same. Thus, d_i is approximately distributed uniformly in 0 ~ 500, consequently, d_kis approximately Gaussian with μ ≈250 and σ≈ 289/√Nk. As shown on table 4, the average differences for those pink lines are around 250. To determine the integrity of the model, we take [0.5*(t_wˆ+ tw)] as the threshold where

t

wˆis two

standard deviations below the mean of d_k for un-watermarked models and tw is two standard deviations above the mean ofd for watermarked _k models. Taking Nk to be 100, the threshold is [0.5*(2211.2+307.8)] = [1259.5] = 1260. Wheneverd_kis not greater than 1260, we conclude that points on section k are authentic such like points on section one of Aardvark (table 3).

Table 3. Aardvark extracted result for section one

Hypothetic Extracted Differences

wi wˆ i |wˆ - wi i| 0000-|wˆi- wi| di 4346 2386 1960 8040 4346 6433 2087 7913 … … … 4346 4396 50 9950 50 4346 4394 48 9952 48 4346 4347 1 9999 1 … … … 4346 6420 2074 7926 4346 6419 2073 7927 Extracted result 1 d= _40.3

4.2. Attacks simulations

A series of non-malicious attacks are applied on watermarked Aardvark (H=2) uniformly scaled by 2, & uniformly scaled by 1.5 then translated by 1 unit. As the extracted results summarized in table 5, the proposed scheme is not affected by translation and uniform scaling due to the normalization process in embedding and extracting phases.

Partially enlarged attack is also applied on watermarked Aardvark where table 6 shows the (a) original, (b) attacked model such that its nose is enlarged 1.2 times (27 points are involved), and their corresponding extracted results. As in (b), both d₁& d₂ yield unacceptable results (>1260) since these 27 points are scattered in both sections. We can conclude that the model is attacked even though it is hard to notice from its appearance.

Resampling attack (attack a) is simulated on Dog (H=11). The simulation is done by merging two points (no.127 & no.128) into one (no.128) which

causes little difference in appearance. Extracted results are in table 7. As rows indicated attack a shown, results on sections 3~6 (shaded cells) are detected as having been affected while other sections are not affected. Although only one point is merged, it causes different partition in H sections and consequently neighboring sections may also be influenced. Finally, the reordering attack (attack b) is applied on Dog. The simulation is done by switching two points (no.10 & no.20) and their corresponding face information. Notice that although the ordering of points has been switched, the model is not modified. Therefore, our algorithm should confirm that the model is authentic. In table 7, the rows indicated attack b exhibit this fact.

4.3. Quality measurements

To measure the impact of watermarking on models, we adopt two formulas from [3] and [13]. Authors in [3] used PSNR, Eq. (11), to evaluate the transparency of 3D watermarked models.

(11) , ) ( max log 10 ₂ 2 10

∑

− ′ ∗ = n n n n I I I N PSNR

where N is total number of points in the model,

n

I

and

I′

_n are geometric information on point n before and after watermarked. Table 8 lists PSNR values of our method and the method in [3]. As it is shown, the PSNR values are very satisfying for our method.

Authors in [13] use MSE, Eq. (12), to measure the quality of the watermarked models.

(12) , ˆ 1 2 1 v -v N MSE N i i i

∑

= =

where N is total number of points for the model,

i

v

and

v′

_i are geometric information on point i before and after watermarked. Table 9 shows MSE values. Although we do not have Screwdriver, comparing those values, there is an impressive difference in those values. From both tables, our

Table 4. Before & after watermarked before after Extracted results: before(blue) & after(pink)

bunny 分290段權重0.5嵌入前後每段的平均差距 0 500 1,000 1,500 2,000 2,500 3,000 3,500 Bin Count 117 84 99 102 119 95 106147132 154164 162127 169126 96 81 114 84 每段包含 點數 平 均 差 距

Embed Average UnEmbed Average

horse 分172段權重0.5嵌入前後每段的平均差距 0 500 1,000 1,500 2,000 2,500 3,000 Bin Count 118 97 101 123 128 145 123 126 120 118 143 77 96 87 88 96 101 每段包含點數 平 均 差 距

Embed Average UnEmbed Average

dog 分 11段 權 重 0.5 - 每 段 的 平 均 差 距 0 500 1000 1500 2000 2500 3000 Bin Count 81 99 122 127 128 143 165 169 175 179 每段包含的點數 平 均 差 距

Embed Average UnEmbed Average

Table 5. Extracted results for Aardvark undergoes

uniform scaling β & translation γ

Extracted results, i.e.,

k d , for Aardvark ( β , γ ) (section) k No.of pts (0,0) (2,0) (1.5,1) 1 130 40.8942 40.8942 40.8942 2 134 340.5648 340.5648 340.5648

Table 6. Extracted result on partially enlargement

(a) No attack (b) Nose enlarged

k=1 40.8942 2335.7905

k=2 340.5648 2409.8598

Table 7. Extracted results: Dog on

resampling (Attack a) and reordering (Attack b)

(section) k 1 2 3 4 5 6 Noattack 99.5 293.2 599.9 597.5 402.2 349 Attack a 99.5 293.2 1964 2385 2629 2546 Attack b 99.5 293.2 599.9 597.5 402.2 349 (section) k 7 8 9 10 11 No attack 21.6 187 33.2 505.6 308.2 Attack a 21.6 187 33.2 505.6 308.2 Attack b 21.6 187 33.2 505.6 308.2

method has little impact on the appearances of models; therefore, the method is very suitable for rigorous instrument models which both integrity and precision are very important.

Time consumption is summarized in table 10 when testing environment is Pentium 4 CPU, 3.20GHz, and 512 MB memory. As illustrated, the proposed method is time efficient that even the complicated model Bunny of 35,947 vertices & 290 sections takes about 4.5 & 3.5 seconds to complete the embedding and extracting.

5. Conclusions and Future Works

This paper proposed a semi-fragile watermarking method for 3D models to verify the integrity of models. Our scheme is robust to uniform scaling, translation, and also robust to vertex reordering attack. The method can detect malicious attacks like partially enlarging, resampling. The receiver only needs the seed number to verify the integrity of 3 D model. Because watermarks are embedded in the normalized Z coord. of the 4th to7th decimal places, the impact on a model is very small, so this method is suitable for rigorous equipment or medical 3D model.

Our method can find local modification region, however, it could not indicate which points have been attacked exactly. In addition, instead of projecting all points on XY-plane, PCA is a good choice to achieve the same goal with rotation invariance. In the future, we would like to enhance the method according to the abovementioned.

References

[1] E. Praun, H. Hoppe, and A. Finkelstein, “Robust mesh watermarking,” Proc. of Int’l Conf. on

Computer Graphics and Interactive Techniques, pp.

49-56, 1999.

[2] J.-W. Cho, R. Prost, and H.-Y. Jung, “An Oblivious Watermarking for 3-D Polygonal Meshes Using Distribution of Vertex Norms,” IEEE transactions on

signal processing, V.55, No.1, pp. 142-155, Jan.

2007.

[3] J. Shu, Y. Qi, S. Cai, and X. Shen, “A Novel Blind Robust Digital Watermarking on 3D Meshes,” Proc.

of the 2nd _{workshop on Digital Media and its}

Application in Museum & Heritages, pp. 25-31, Dec.

2007.

[4] B. Oliver, “Geometry-Based Watermarking of 3D Models,” IEEE Computer Graphics and Applications, V.19, Issue. 1, pp. 46-55, 1999.

[5] Z.Q. Yu, H.H.S. Ip, and L.F. Kowk, “Robust Watermarking of 3D Polygonal Models Based on Vertex Scrambling” Computer Graphics

International, pp. 254-257, July 2003.

[6] Z.Q. Yu, H.H.S. Ip, and L.F. Kwok, “A robust watermarking scheme for 3D triangular mesh models,” Pattern Recognition, V.36, Issue 11, pp. 2603-2614, Nov. 2003.

[7] Z. Li, W.-M. Zheng, and Z.-M. Lu, “A Robust Geometry-Based Watermarking Scheme for 3D Meshes,” First Int’l Conf. on Innovative Computing,

Information and Control, V.1, pp. 253-256, Aug.

2006.

[8] B.-L. Yeo and M.M. Yeung, “Watermarking 3D objects for verification,” IEEE Computer Graphics

and Applications, V.19, Issue 1, pp. 36-45, 1999.

[9] C.-M. Chou and D.-C. Tseng, “A public fragile watermarking scheme for 3D models authentication,”

IEEE Computer-Aided Design, V.38, Issue 11, pp.

1154-1165, Nov. 2006.

[10] H.-T. Wu and Y.-M. Cheung, “A fragile watermarking scheme for 3D meshes,” ACM Proc. of

the 7th workshop on Multimedia and Security, pp.

117-124, Aug. 2005.

[11] H.-Y.S. Lin, H.-Y.M. Liao, C.-S. Lu, and J.-C. Lin, “Fragile Watermarking for Authenticating 3-D Polygonal Meshes,” IEEE Transactions On

Multimedia, V.7, No.6, pp. 997-1006, Dec. 2005.

[12] W. Liu and S.-H Sun, “Rotation, Scaling and Translation Invariant Blind Digital Watermarking for 3D Mesh Models,” First Int’l Conf. on Innovative

Computing, Information and Control, V.3, pp.

463-466, Aug. 2006.

[13] T. Harte and A.G. Bors, “Watermarking 3D models,” Proc. of IEEE Int’l Conf. on Image

Processing, V.3, pp. 661-664, Jun. 2002. Table 9. MSE values

Models Horse Bunny Dog Aardvark Screwdriver

Our method 4.22E-10 1.56E-09 2.50E-10 3.03E-10 N/A

Method [12] N/A N/A 4.98E-03 N/A 3.51E-05

Table 10. Time consumption (in millisecond) Models (N,H) Horse (19851,172) Bunny (35947,290) Dog (1871,11) Aardvark (264,2) Embed 2453 4438 219 31 Extract 1860 3594 172 16 Table 8. PSNR values

Models Horse Bunny Dog Aardvark Our method 88.3738 83.7608 91.5727 90.7543